Hacker News Reader

Comment by endisneigh | Hacker News Reader

How exactly are the ransoms even paid out? I would assume cryptocurrencies, but before those existed how did they pay out?

I'm not sure what it would be called, but has there been any investigation in a sort of "transparent by default" database system? Ideally if this were possible people wouldn't need to care about data being stolen (though in this case it's unclear what the attack did, but many times it's more like we'll reveal/block your data unless you pay up)

View on HN

Before cryptocurrency you had to buy things from shady online pharmacies or send/fund Visa gift cards. Source: https://www.varonis.com/blog/a-brief-history-of-ransomware/

Crypto is really what's made ransomware at the scale we see it now possible.

I suspect it changes the profile of who gets hit. Individual-level targets would get extorted for maybe a couple hundred bucks - sums that are reasonable to transact in iTunes cards or whatever. Those numbers are low both because it's what that category of target is willing/able to cough up financially, and what they were able to transact irreversibly. Conversely, your meat-packing CEO isn't going down to the corner store for $11m in phone credits, so it was less worth it to go for targets with deep pockets, that might be better-protected, instead of casting a wide net for a lot of easy small hits. The ability to irreversibly and kinda-anonymously transact large amounts definitely incentivizes going for institutional targets.

Crypto makes it more efficient. It would still occur without crypto just fine. Your talking about a black market worthy many millions, maybe billions.

Ransomware wasn't nearly as prevalent prior to cryptocurrency because moving that kind of money was much harder.

Another interesting shift is that complete administrative takeover is often less compelling: Software is more secure covering administrative functions, but users, which have access to all of your business data, are vulnerable as ever.

I've only heard of ransomware over the past 8 years or so. Crypto, has done a lot for making such payment processes more palatable to criminal orgs.

The ransomware typically replaces your computer screen with a unique crypto address.

The remote server knows to unlock your computer and cleanse it of the ransomware upon receipt of payment.

Many also leave a marker on your system/network preventing reinfection. Most ransomware is from the same vendor rented out which prevents reinfection, for now.

Reply on news.ycombinator.com