Attacks/Breaches

7/18/2016
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Victims Rarely Pay The Full Ransom Price

The purveyors of cyber-extortion schemes often willing to negotiate their ransom fees, F-Secure study finds.

Victims of ransomware scams almost never need to pay full sticker price to get their encrypted data back.

Those willing to negotiate can often get their ransom amount reduced substantially and obtain useful deadline extensions for paying it, a new report from F-Secure shows.

The security vendor recently conducted an experiment to evaluate what it described as the "customer experience" associated with five crypto-ransomware samples currently in the wild. The families evaluated for the experiment were Cerber, Jigsaw, Cryptomix, Shade, and TorrentLocker.

For the experiment, researchers at F-Secure created a victim persona named Christine Walters and used a fake Hotmail account in her name to communicate with the ransomware operators via their support channels. In order to appear convincing, Walters’ persona was made to appear as though she knew very little about ransomware, security, and Bitcoin, the preferred online currency for making ransom payments.  

The exercise showed that when victims dig in their heels a bit, criminals are likely to relent and try to make what they can rather than risk losing everything, says Sean Sullivan, security advisor at F-Secure.

“If you find yourself compromised, haggle,” Sullivan says. “Ask questions. Interact with the ransomware agent and get a feel for their responsiveness. The majority want to get something rather than nothing, and will cut a deal to close the case.”

The criminals behind three of the five ransomware families in F-Secure’s experiment were willing to negotiate on the ransom amount when asked. On average, they dropped the ransom amount by 29%. The TorrentLocker operators did not respond at all to "Walters’" emails, while those behind Cerber flatly refused to negotiate. In each case, the agents with whom Walters communicated were similarly willing to extend their payment deadlines--sometimes by days--when asked.

The operators of Cryptomix had the highest initial ransom amount at around $2,000. But when F-Secure’s reviewer protested the sticker price, the Cryptomix agent who responded to her email first dropped the demand by $1,000. Over the course of the next two days, the agent agreed to drop the demand by another $350, before holding firm at $650.

Similarly, the agent responding to emails pertaining to the Shade ransomware sample was willing to drop the ransom amount from $400 to $280 when F-Secure’s reviewer protested the original amount.

Among the ransomware families in the F-Secure study, the one with the best customer support was Jigsaw. The initial ransom amount at $150 was substantially lower than the ransoms demanded by the other ransomware families. The support agent for the malware agreed to reduce the amount to $125 when requested, and then offered help in finding a Bitcoin vendor. The Jigsaw support agent even helped F-Secure’s reviewer find stores in her local area that accepted payments for Bitcoins using Paysafecards, and also offered to stay online while payment was made.

“The perceived friendliness of some of the interactions was sincerely confusing to our reviewer,” Sullivan says. “Had they not been coached by me, I suspect they might be successfully socially engineered in other circumstances.”

English was the preferred language of communication for all of the malware families that F-Secure reviewed and all the chat interactions demanded knowledge of English.

Since 2005, the FBI’s Internet Crime Complaint Center (IC3) has received more than 7,700 complaints involving ransomware according to data released earlier this year. The incidents have resulted in victims paying more than $57 million in ransom money to cyber extortionists. The ransom fees have ranged in amounts from $200 to $10,000.

In addition, over the last one year, the US Department of Homeland Security has received over 320 incident reports of ransomware related activity on 29 federal agency networks. So far, though, no federal agency has had to pay a ransom in order to get ransomware removed from their computers, DHS says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
A41202813GMAIL
50%
50%
A41202813GMAIL,
User Rank: Apprentice
7/21/2016 | 1:12:20 AM
Re: Positive
What Is The Difference Between RansomWare And A System Hard Drive Completely Unrecoverable ? - Absolutely None.

 

Some Basic Users Can Be Caught With Their Pants Down, But, For Companies, The Absence Of Multiple Backups Is Unforgivable - Any IT Manager Incapable Of Solving This Problem Single Handedly Should Be Fired On The Spot.

 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
7/20/2016 | 7:25:02 AM
Positive
That's good to know and shows that Ransomware doesn't necessarily need to be quite as scary as it often seems. Considering the hackers are getting something for nothing though, it makes sense that they would work with those affected - especially since an unfamiliarity with Bitcoin is likely to be common place in the people who are caught out by phishing and other scams that lead to ransomware infections.
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14981
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005.
CVE-2018-14982
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004.
CVE-2018-15482
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006.
CVE-2018-15473
PUBLISHED: 2018-08-17
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2018-15471
PUBLISHED: 2018-08-17
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or c...