Attacks/Breaches

7/18/2016
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Victims Rarely Pay The Full Ransom Price

The purveyors of cyber-extortion schemes often willing to negotiate their ransom fees, F-Secure study finds.

Victims of ransomware scams almost never need to pay full sticker price to get their encrypted data back.

Those willing to negotiate can often get their ransom amount reduced substantially and obtain useful deadline extensions for paying it, a new report from F-Secure shows.

The security vendor recently conducted an experiment to evaluate what it described as the "customer experience" associated with five crypto-ransomware samples currently in the wild. The families evaluated for the experiment were Cerber, Jigsaw, Cryptomix, Shade, and TorrentLocker.

For the experiment, researchers at F-Secure created a victim persona named Christine Walters and used a fake Hotmail account in her name to communicate with the ransomware operators via their support channels. In order to appear convincing, Walters’ persona was made to appear as though she knew very little about ransomware, security, and Bitcoin, the preferred online currency for making ransom payments.  

The exercise showed that when victims dig in their heels a bit, criminals are likely to relent and try to make what they can rather than risk losing everything, says Sean Sullivan, security advisor at F-Secure.

“If you find yourself compromised, haggle,” Sullivan says. “Ask questions. Interact with the ransomware agent and get a feel for their responsiveness. The majority want to get something rather than nothing, and will cut a deal to close the case.”

The criminals behind three of the five ransomware families in F-Secure’s experiment were willing to negotiate on the ransom amount when asked. On average, they dropped the ransom amount by 29%. The TorrentLocker operators did not respond at all to "Walters’" emails, while those behind Cerber flatly refused to negotiate. In each case, the agents with whom Walters communicated were similarly willing to extend their payment deadlines--sometimes by days--when asked.

The operators of Cryptomix had the highest initial ransom amount at around $2,000. But when F-Secure’s reviewer protested the sticker price, the Cryptomix agent who responded to her email first dropped the demand by $1,000. Over the course of the next two days, the agent agreed to drop the demand by another $350, before holding firm at $650.

Similarly, the agent responding to emails pertaining to the Shade ransomware sample was willing to drop the ransom amount from $400 to $280 when F-Secure’s reviewer protested the original amount.

Among the ransomware families in the F-Secure study, the one with the best customer support was Jigsaw. The initial ransom amount at $150 was substantially lower than the ransoms demanded by the other ransomware families. The support agent for the malware agreed to reduce the amount to $125 when requested, and then offered help in finding a Bitcoin vendor. The Jigsaw support agent even helped F-Secure’s reviewer find stores in her local area that accepted payments for Bitcoins using Paysafecards, and also offered to stay online while payment was made.

“The perceived friendliness of some of the interactions was sincerely confusing to our reviewer,” Sullivan says. “Had they not been coached by me, I suspect they might be successfully socially engineered in other circumstances.”

English was the preferred language of communication for all of the malware families that F-Secure reviewed and all the chat interactions demanded knowledge of English.

Since 2005, the FBI’s Internet Crime Complaint Center (IC3) has received more than 7,700 complaints involving ransomware according to data released earlier this year. The incidents have resulted in victims paying more than $57 million in ransom money to cyber extortionists. The ransom fees have ranged in amounts from $200 to $10,000.

In addition, over the last one year, the US Department of Homeland Security has received over 320 incident reports of ransomware related activity on 29 federal agency networks. So far, though, no federal agency has had to pay a ransom in order to get ransomware removed from their computers, DHS says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
A41202813GMAIL
50%
50%
A41202813GMAIL,
User Rank: Apprentice
7/21/2016 | 1:12:20 AM
Re: Positive
What Is The Difference Between RansomWare And A System Hard Drive Completely Unrecoverable ? - Absolutely None.

 

Some Basic Users Can Be Caught With Their Pants Down, But, For Companies, The Absence Of Multiple Backups Is Unforgivable - Any IT Manager Incapable Of Solving This Problem Single Handedly Should Be Fired On The Spot.

 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
7/20/2016 | 7:25:02 AM
Positive
That's good to know and shows that Ransomware doesn't necessarily need to be quite as scary as it often seems. Considering the hackers are getting something for nothing though, it makes sense that they would work with those affected - especially since an unfamiliarity with Bitcoin is likely to be common place in the people who are caught out by phishing and other scams that lead to ransomware infections.
6 Ways Greed Has a Negative Effect on Cybersecurity
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  6/11/2018
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12026
PUBLISHED: 2018-06-17
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in tur...
CVE-2018-12027
PUBLISHED: 2018-06-17
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said ...
CVE-2018-12028
PUBLISHED: 2018-06-17
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an e...
CVE-2018-12029
PUBLISHED: 2018-06-17
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...
CVE-2018-12071
PUBLISHED: 2018-06-17
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.