Slashdot Mirror
Paying Hacker Extortion
An anonymous reader writes "A friend works as CIO at a medium sized publicly traded company. The company was contacted by a hacking group and told to pay $100,000 to prevent their company from being hacked/attacked. They actually paid the extortion (told authorities after). The authorities said the company could be charged with supporting Terrorists. Seeing that most publicly known hacks are costing companies this size nearly a million dollars, Is this supporting terrorists or supporting stockholders?"
Is this supporting terrorists or supporting stockholders?
1) Neither, it could be a 12 year old with hotmail sending threatening emails.
2) Both, it is another corporate goon protecting his stock options.
3) None, they were paid out in Botcoins.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
They'll just be hacked anyway.
Is this supporting terrorists or supporting stockholders?
One in the same...
PayPal? Besides airdropping suitcases full of cash into the ocean, how do corporations pay ransom these days?
How about hiring someone who actually has some idea about security. THAT is supporting stockholders.
Seven puppies were harmed during the making of this post.
It seem's like it is making everyone happy these days.
News agencies are creaming their panties.
Companies get to sweep shit under the rug while their competitors crash and burn. (I bet you Microsoft was heart broken to hear the PSN got hacked.)
Hackers make some money and who knows might eventually get laid.
The Government gets to restrict our freedom's and buy bigger shiny new toys and has even more reasons to keep printing money until it costs more to print it than its worth.
I get the pleasure of changing my password every twenty minutes to something like LKJGDSKLeiojgtqpltjwe4jt]90iejaasdfHippofucknuggets
Everyone WINS!
Paying ransom is almost always a bad idea for the community as a whole. The authorities are simply trying to make the company do the right thing instead of the selfish thing. The biggest problem with security is that the incentives are rarely aligned with the responsibilities; this is a classic case of re-aligning those by pushing the societal cost back to the people who are in a position to make the decision.
With the savings your friend could hire some real security experts to keep their systems online.
As for the terrorism bit, it makes me wonder when we can sue members of Reagan Administration for arming the proto-Taliban, Saddam Hussein, and Iran. Clinton and Obama owe us a few bucks for Pakistan too, when they inevitably start arming terrorist in the near future. What's good for the goose is good for the gander, right?
Is this supporting terrorists or supporting stockholders?
"Supporting terrorists" is a stupid description, and the idiot who said that needs a kick in the teeth. However, also stupid was paying these jackasses. Take every precaution you can, get the authorities involved as a backup, maybe even alert your shareholders to the threat, but do not pay extortionist script kiddies.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
What's the name of your friend's company?
Am I alone in finding this story incredibly sketchy? Either the company, the poster, and the police are stunning idiots, or it's just bullshit created to inflame a bunch of slashdotters.
If some kind of attribution can't be found, I call BS.
Three Squirrels
Dane-geld
(A.D. 980-1016)
IT IS always a temptation to an armed and agile nation,
To call upon a neighbour and to say:—
“We invaded you last night—we are quite prepared to fight,
Unless you pay us cash to go away.”
And that is called asking for Dane-geld,
And the people who ask it explain
That you’ve only to pay ’em the Dane-geld
And then you’ll get rid of the Dane!
It is always a temptation to a rich and lazy nation,
To puff and look important and to say:—
“Though we know we should defeat you, we have not the time to meet you.
We will therefore pay you cash to go away.”
And that is called paying the Dane-geld;
But we’ve proved it again and again,
That if once you have paid him the Dane-geld
You never get rid of the Dane.
It is wrong to put temptation in the path of any nation,
For fear they should succumb and go astray,
So when you are requested to pay up or be molested,
You will find it better policy to says:—
“We never pay any one Dane-geld,
No matter how trifling the cost,
For the end of that game is oppression and shame,
And the nation that plays it is lost!”
"Are they made from real Girl Scouts?" ~Wednesday Addams
So you say a mid-sized company paid a $100,000 extortion? That money with 'poof', right? Untraceable, right? Call me the suspicious sort but are we sure this is extortion and not embezzlement?
Cheers,
Matt
They bought something for that $100k, namely the hacker document his hack. I'm sure she even did a contentious job for a coked up Belorussian teenager who's english does not extend beyond text speak.
Yeah, sure $100k sounds steep for simply documenting a handful of security bugs, but they were the bugs that might've bitten you for $1M. And surely you saved way more by building your site using cheap ass Visual Basic developers, right?
Anyways, anyone who views hacking as terrorism is a moron, especially the authorities who threatened the company.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
That's the whole point of "terrorism". You can label anything terrorism, and all of a sudden none of the old rules apply.
Give me Classic Slashdot or give me death!
Quite frankly, I could care less. After all, it's not rocket surgery.
a) i wonder which idio put his/her signature under such a transfer. I presume there was no life in danger, which is the only reason one could think about supporting criminals. Fuck these guys (the crackers and the company). For 100000 dollar i can invest enough time to hack (presumably by social engineering and really simple attacks) into at least 10 companies; and i am not a professional, neither white-hat, nor black-hat.
b) From the formal viewpoint, this looks like corruption. You pay people without any proof that they did something for you for a lot of money. Who keeps some employee from sharing his secrets and getting something back from some friends? Would be too easy!
c) If they have been hacked already and just pay the blackmail money not to see their customer details in the newspaper, then it would be better to be completely honest about it.
d) I dont think it should be considered to be "supporting terrorists", but it could be funding well organized crime.