Now that I think about it: It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it?

Or a single fake story about how ransom doesn't give your data back, published in a high-profile newspaper.

Come to think of it, our news sources write bigger lies every day, here they could actually do some good without any risk to their own reputation.

Unfortunately they are also cut throat with regard to each other. The first paper that does this risks the rest of them running stories about that source scare mongering and deliberately spreading panic on behalf of [insert conspiracy theory and/or unpopular agency here].

Most of us in this thread ARE adequately prepared with backups, so it's easy to forget that yeah, someone should probably value their family memories over an infinitesimal effect on the scammer business by not paying. A lot of people here seem to suggest lying to or misleading people to believing they can't get their stuff back is a solution, while ignoring that it leaves people... unable to get their stuff back.

That's enough to hose 99% of users, even the ones following traditionally sufficient practices. You're only safe if you have offsite backups with drives that didn't mount to your computer recently.

Or if your backup solution is—from the perspective of the computer being backed up—an append-only store. Like a box of tapes, or Tarsnap using restricted keys, or Arq pointed at a versioned S3 bucket, or a NAS exposing an iSCSI target backed by an LVM thin pool LV with automatic daily snapshots.

Sadly, as far as I know, no turn-key hardware "home backup" or "home NAS" product is in that category, though.

Every time I say this, someone chimes in and says that in their office, they air gap tape drives and do all sorts of things with storage snapshots. If you're an enterprise - great. A large proportion of "two laptops" businesses have no backups at all, or a "I selectively place important things in Dropbox" setup. This team went and bought a NAS and setup backups. Good on them. It was sad to see cryptolocker take down both desktops, and all backups on the NAS.

The email he received sent him to a website with a convincing looking download, which came up 0/55 on virustotal. He even told me he wouldn't have run an executable - but it was a Word document. It can be truly depressing to see who cryptolocker affects sometimes.

On the other hand, if there were an off-the-shelf product for this, it would probably have unpatched security issues two weeks after you bought it, and if it were in common use you'd see ransomware targeting it. Tough problem to solve if you're not running and maintaining your own devices.

I suppose tarsnap or S3 would be the way to go, I'm just not that into cloud backups. Maybe it's time to get over that.

I'm waiting for the NAS "appliance" that's actually running CoreOS, and then just relies on running the :latest tag of some popular Docker image (and not a fork of it that they'll forget to update eventually; the original upstream image), plus a bit of config-file glue generated into a shared volume from a web-UI service running in another container. (Bonus points if the second container is only started up, for an hour at a time, when you press a button on the NAS, WPS-style.)

Such a design is essentially the same as shipping the device's OS as "firmware" with auto-updates, but for the fact that the vendor themselves isn't anywhere within the path of creating or distributing those updates. Which, in the end, makes all the difference.

Or doesn't mount to the source computer(s) at all.

My active machines push backups to intermediate locations, and the true backup locations pull from there and create snapshots. Status information used to verify the backup process is passed back the other way. The active machines don't (in fact can't) authenticate with the main backups and vice versa, reducing the likelihood that someone hacking into one can easily compromise the other at the same time.

I wouldn't expect the man on the street to muck around setting this up though, but many cloud backup solutions effectively do this if they don't have an easy "delete snapshot" API call or similar. I'm surprised that the "soft offline" backup side of it isn't marketed more actively. Maybe no one thinks they can adequately explain the benefit to the man on the street without putting them off by it being a little more complicated than a simple file copy.

No, they (usually) work similar to PGP/GPG, i.e. each file is encrypted with a different AES key and the AES key is encrypted with a public RSA key. The original AES key for a particular file is immediately deleted from memory after the file is encrypted and the private RSA key (needed for decrypting the AES key that is stored in the file) only ever gets delivered to the system if the ransom is paid.

Sometimes the way they keep the dishonest guys in line is by attacking others who try to get in on the scheme. Traditionally this would be breaking people's knees, and I imagine well-organized cyber crime boils down to the same thing in the end.

> Sometimes the way they keep the dishonest guys in line is by attacking others who try to get in on the scheme.

Are you really trying to frame some extortionists/scammers as honest and some as dishonest? How about they all are criminals, extorting money as they do from random people, they don't care about?

Thus I think a scammer can be called dishonest.

That seems to be the problem, then. Call it a restricting context and we are back to the matters of good and evil.

I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies.

To be clear, I also don't recommend paying the ransom, but the work is often impressive.

Nope, doesn't check out.

Think of criminals doing ransomware as if it was a small startup, for which profits are strongly dependent on reputation, and where your "customer support" is actually handled by the founders themselves. They have every reason to help, because it literally keeps their business model alive.

I'm extremely skeptical of the people that say ransomware is good for the economy or whatever. Broken window fallacy. Sure it creates an incentive to protect against hackers. But isn't that a bit circular? Hackers are good because they create inventive to protect against hackers? Ransomware is by far the most economically damaging kind (and personally damaging, for all the people that lose their family photos...)

Theres a lot of blame to go around for this situation. Shitty anti virus companies that sell a false sense of security and barely work. The broken security model of windows and most software. How inconvenient and expensive it is to actually do backups, so because of most basic human psychology most people put it off... If they are even technically minded enough to know they should, and most people aren't. Programs that pollute my home folder and documents with garbage that increases the space necessary to backup (OK that's just my personal issue.)

is it though, compared to malware ? Consider an elderly person who gets infected with malware/spyware, making his user experience frustrating and confusing. 2 or 3 trips to the Geek Squad for $150 a visit and you're at the same financial loss as paying a ransom. I'm sure there are also people who just dont use their computers due to infections.

Plus, malware has got to be much more prevalent, at least for a long time it was, not sure what the state of it is now. So in total, I would wager that many more dollars have been spent for techs to remove it than have been spent on ransomware.

It's pretty hard to say that users "should be safe from this" - most of the solid solutions discussed in this thread are probably used by <5% of people, and maybe much less than that.

Sounds like an easy way to get rid of ransomware. Just spread rumors that you didn't get your files back even though you paid.

Somehow I have a feeling that wouldn't work, though. Many people would still pay.

For most I think that's the wrong target. Establishing & maintaining totally seamless, push-button rolling restore costs a lot of effort & money.

In the event of failure (which is not guaranteed), you burn a day or three getting things back to normal. So long as failures are rare, this can be cheaper (though availability suffers)