“I was told to buy a software or lose my computer: I ignored it”

https://blog.acolyer.org/2019/10/16/ransomware/

by feross • 7 years ago

68 61 7 years ago

blog.acolyer.org

mysterypie• 7 years ago

With a U.S. population of ~200M, let’s call it 4M infections/year. We know that 4% of respondents paid the ransom, so that’s 160,000 ransom payments. If we say $200 per paid ransom as a guess, that means the ransomware ‘industry’ is making about $32M a year.

The U.S. population is actually ~327M, but since we're talking ballpark figures, let's just say that ~200M represents the adult computer-using population. It strikes that ransomware is both much bigger and much smaller than I thought. The 160,000 ransom payments is much bigger than I would have guessed. It's not like being struck by lightning; it's more like a serious car accident. But the actual revenue generated, $32M as he's estimated, is pitiful. There are all sorts of illegal, quasi-legal, and legal ripoffs that generates billions per year. For the amount of attention ransomware gets, it's just noise.

mannykannot• 7 years ago

The attention seems to be due to two factors: the high-profile cases that hit large organizations like school districts, local government or hospitals (which are not affected by common scams), and the relative novelty of using cryptocurrency for paying the ransom (though not predominantly, according to this survey; I would guess that using cryptocurrency reduces the yield from the individual users that are the common victims.)

Frye• 7 years ago

For now it may be just noise, but the ransoms are quickly getting bigger and bigger. Last month I facilitated the payment of 3 BTC to decrypt the files.

celticninja• 7 years ago

I imagine these sort of attacks are more like spear phishing, in that they look for high value targets. No one is paying $25k for the family laptop files, but a medium sized business,perhaps digital in nature, would be quick it pay that price to fix the problem.

sp332• 7 years ago

Ransomware can be hard to trace, which keeps risk low, and that means criminals can afford to ask for less money. It's also a benefit to keep the ransoms small enough that people will pony up instead of getting the FBI involved.

est31• 7 years ago

As with most criminal activity, the damage created by it is much larger than the money made. I couldn't find any US figures, but global estimates claim ransomware-caused damages of 11.5 billion USD in 2019: https://cybersecurityventures.com/ransomware-damage-report-2...

dhruvmittal• 7 years ago

I'm guessing the damage numbers are higher because of a number of high-impact city-focused attacks. I live in Baltimore, where all of the city's systems were shut down for a few months over a ransomware attack asking for <100k. A similar attack occurred last year in Atlanta; wikipedia quotes a demand of 50k & Atlanta estimated around 10M in contractors for recovery.

https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_atta...

codemac• 7 years ago

This was calculated by Cisco & Cybersecurity Ventures, who both directly profit from the fear generated by these figures. I do not trust these figures.

This is marketing for CIO/CISO's to read so they make sure to add in various security features to their BoM for purchase.

vonmoltke• 7 years ago

As with most criminal activity, the damage created by it is much larger than the money made.

That's what makes extortion work. If the cost to avoid damage is on par with the potential damage, few if any victims would actually pay the criminal. The extorted amount being a fraction of the potential damage makes victims more willing to pay.

Bartweiss2• 7 years ago

Hm, that's an interesting calculation. I'm glad you added it here, it's a useful reference point, but it does look like some serious sleight of hand was done to produce it.

The report is from 2017, and relies on a 300% increase in the rate of ransomware to get that 2019 cost. That sounds high, but apparently the 2016 rate did triple in that much time (although the WannaCry spike drove a bunch of that).

On the other hand, it appears to be assuming 300% growth in attacks with a a constant rate of victimization. This doesn't make much sense alongside stats like "In 2016, an average of 40 percent of spam emails contained malware links to ransomware, an increase of 6,000 percent over 2015, when less than one percent contained ransomware." That's a qualitative change from "not a threat" to "threat", and presumably 40% -> 80% would not double attack success rates.

Further, the damage stat attempts to include subjective costs like employee training and reputational harm, as well as a naive calculation of revenue costs which assumes no revenue lost to donwtime will be recovered post-attack. That's a fairly reasonable corporate estimate, but summing it across all victims this way isn't valid at all. Only a fraction of that balance-sheet loss is actual GDP-shrinking damage, while the rest becomes either loss to competitors or value-creating OpEx like security and training investment.

Hilariously, one of the linked Cybersecurity Ventures writeups also claims[1] that "cybercrime will cost the world in excess of $6 trillion annually by 2021, making it more profitable than the global trade of all major illegal drugs combined". It's amazing what kind of numbers you can invent when you compare the societal cost of one crime to the net profit of another. As much as I love William Gibson, I don't think the cartels will be swapping their chemists for programmers within the next two years.

[1] https://blogs.cisco.com/financialservices/ransomware-lessons...

downrightmike• 7 years ago

Now that there is insurance for ransom ware, The insurers are usually paying the criminals, which will only lead to more attacks.

tmikaeld2• 7 years ago

On MacOS, the free "RansomWhere?" tool is a really nice thing to have, it warns if any app is hammering files and stops it until you approve/deny.

https://www.objective-see.com/products/ransomwhere.html

vezycash2• 7 years ago

Windows 10 now has in-built randsomware protection with Windows Defender.

jermaustin1• 7 years ago

Does it actually work? I haven't had a virus in decades to my knowledge, and I stopped running virus scanners back in 2005 or so. Windows Defender is on my computer, but I never run a scan. Maybe it does in the background, but I've never seen anything notifying me about a virus or ransomware or malware.

aloknnikhil• 7 years ago

Second this. The only annoying thing about it is the number of false positives. When I leave a large build running overnight, it randomly triggers the check and halts the entire build.

retSava2• 7 years ago

Sounds like a scenario easily foreseen since a build should work on lots of files... Can't you whitelist the binaries involved?

Wowfunhappy2• 7 years ago

I am going to start using this immediately, thank you.

I have long wondered why precisely this isn't built into all the major OS's.

Edit: Although, reading more, I'm not sure I love how the logic works. For instance, it ignores all Apple apps. I understand the logic behind that, but there should be different thresholds: If any process on my machine, Apple or not, rewrites 10GB or more (to choose a somewhat arbitrary amount), I want to know about it ASAP. Otherwise, what if the ransomware finds a way to leverage Apple processes?

tmikaeld2• 7 years ago

There's no need to monitor Apples own processes because MacOS already do that with "System Integrity Protection" which stops any modification of system files.

See here: https://support.apple.com/en-us/HT204899

djhaskin987• 7 years ago

"Removed by someone else" = my family member called me up in tears

jnty• 7 years ago

Interesting that despite the huge effort both sides put in to to fixing/exploiting vulnerabilities the biggest risk factor seems to be directly downloading random dodgy stuff.

thomascgalvin• 7 years ago

I suspect that this is always going to be the case. There are a lot of people literate enough to operate a computer, but not literate enough to understand the risks they're taking by running something they download off of scammers.ru. Exploiting these people will always be easier than actively circumventing OS-level security.

inanutshellus• 7 years ago

I was going to say "Desktop apps need permissions like Android apps" that ask your permission to access resources and then was immediately reminded of the "I'm a Mac" commercials mocking Windows for doing exactly that... /Le sigh/...

I used to use this software called Clean Slate that would watch all the changes you made to your computer and undo them when you restarted. Maybe it's time for Grandma to get her own Docker instance.... :-)

dragontamer2• 7 years ago

I mean, there's a reason why Microsoft wanted to lock the typical user behind PKI-verified Windows Store apps with extremely limited access to the raw resources of a computer.

Lev1a• 7 years ago

Yes, making Windows into a walled garden similar to Apple so they can exert more influence on their users than ever before.

cat1994• 7 years ago

usually I don't say anything since this usage is so prevalent, and I typically hate being pedantic about grammar, but since this is a journal title:

it is not 'a' software. not here, not there, never. the construct <category-of-material>-ware is plural. period. therefore there can never be 'a' of them.

it is 'software' or 'a <noun describing unit> of software', e.g. 'a piece of software' or perhaps '<quantifier> software' as in 'some software' 'this software', 'malware removing software', etc. 'a software program', which can be shortened to 'a program', etc, is fine, because the 'a' refers to 'program', which is implicitly in the singular.

matthewowen• 7 years ago

Uhhhhh it's a quote from someone who said it that way, and that choice is presumably meant to convey that they aren't particularly tech savvy.

posterboy• 7 years ago

this is both non-sense. proscriptive arguments drawn from nothing but your single minded authority have little value in discurs. "a software" (sorry) is quite frequent. fullstop.

Ger ware is singular by the way.

cat1994• 7 years ago

in this case, then it makes much more sense.

etbebl• 7 years ago

<category-of-material>-ware is plural. period.

Actually it's an uncountable noun. You use a singular verb form - "the software is" not "the software are." But you can't pluralize it or use an indefinite article.

Same with "code," unless it means "cipher" or "regulation."

cat1994• 7 years ago

ah yes. uncountable. was trying to find the correct terms. thanks.

jansan• 7 years ago

At the end of the article you can see quite a bold attempt at curve fitting.

nothrabannosir• 7 years ago

Not to mention that there is very little motivation given for the quantification of the individual threats. Not having 2fa is apparently 1 point, backing up only ever few weeks is 2, .. it almost seems as if these were chosen retroactively to make the curve look the way it does.

From the paper:

Given the results above, we now present and discuss a proof-of-concept approach to risk assessment to estimate futureransomware infection that is based only on self-reported se-curity habits and past exposure to online scams. The methoddemonstrates that assessments can, in theory, be made with relatively little information, enabling consumers to estimatetheir own risk. We stress from the outset, however, that wemerely intend to illustrate the general approach; in particular, the strategy we present would need to undergo more rigor-ous evaluation before it could be responsibly used for riskassessment in the broader population.

Seems tenuous, that disclaimer notwithstanding.

jmmcd• 7 years ago

it almost seems as if these were chosen retroactively to make the curve look the way it does.

That's what regression does! And maybe they should've used regression, indeed. Instead, this looks more like an "improper linear model" http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.188.... -- something we see less and less of now that regression models are at our fingertips.

rambojazz• 7 years ago

It looks about right though, doesn't it? What else would fit the dots better?

IOT_Apprentice• 7 years ago

I don't understand the title of the article or presentation. It appears to be a quote, and on first glance doesn't seem to be part of the article body itself.

Const-me• 7 years ago

Offline backups.

A ransomware can technically encrypt all drives, steal password from cloud backup software, and destroy it too. Or they can be destroyed by uploading encrypted files. No software can destroy data on a hard drive that's disconnected and unpowered. Only I can.

“I was told to buy a software or lose my computer: I ignored it”

Related Stories