Slashdot Mirror
Victims Aren't Reporting Ransomware Attacks, FBI Report Concludes (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Despite being an expanding threat, ransomware infections are rarely reported to law enforcement agencies, according to conclusions from the 2016 Internet Crime Report (PDF), released yesterday by the FBI's Internet Crime Complaint Center (IC3). During 2016, FBI IC3 officials said they received only 2,673 complaints regarding ransomware incidents, which ranked ransomware as the 22nd most reported cyber-crime in the US, having caused just over $2.4 million in damages (ranked 25th). The numbers are ridiculously small compared to what happens in the real world, where ransomware is one of today's most prevalent cyber-threats, according to multiple reports from cyber-security companies.
Companies don't want outsiders to know that they have incompetent IT folk working for them. Or... they don't want people to know that they can't afford (or have chosen not) to upgrade their equipment and software. Or... they don't want people to know that management is incompetent.
Law enforcement isn't going to do anything to help you about ransomware hitting your computer. For the victim, it's a waste of time.
It's not like they are particularly trusted or trustworthy. And I've never even heard of the "Internet Crime Complaint Center" and that likely goes for most people. The average person would only contact the FBI if they expected that the FBI would have some chance of doing something about the bad guys, and I just don't see that happening.
Or you are worried that their investigation might uncover other unrelated things that you would rather them not know about.
WTB [sig], PST!!!
It's kind of futile to report them, isn't it? The US doesn't have any meaningful ability to deal with attackers in Nigeria, much less China or Russia. Or am I wrong? I'd be happy to tell my customers they have some recourse.
Most companies don't report ransomware attacks to the FBI because most companies consider it a waste of time. Everyone knows that if you get hit by ransomware, there's only three possible outcomes:
1. You consider the encrypted data lost, and move on without it, or roll back to your freshest, unencrypted backup.
2. You pay the ransom and hope to get the data back.
3. You get lucky and the ransomware that hit you is one that's already been broken and you're able to recover the data yourself.
There's nothing the FBI can do to alter those three options. The feds aren't going to track down the originator of the ransomware and force him to give you the decryption key. And even if they could, it would be pointless because very few companies could afford to spend the weeks, months, or even years it would take for the FBI to complete such an operation. I'd be willing to bet that for most companies that get hit by ransomware, the biggest headache is the halt to production that occurs while the data is being recreated or recovered, either from backups or by paying off the ransom. Adding the FBI to the mix does nothing but add more paperwork and more meetings to the this process.
I get on the order of 50,000 attack probes every day. Should I be cataloging and report each one to the FBI?
What makes a ransomware attack a special snowflake attack that needs reporting compared to spyware or bot install attempts?
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
... when we say, "Don't go to the police," we mean it.
Soon after, another email from the Dark Overlord arrived at Larson. “They said they felt they owed us an explanation as to why they had done it,” said Jill Larson. In the email, the hackers argued that Larson Studios had broken the terms of the agreement by talking to the FBI. “So they decided to punish us.”
It little behooves the best of us to comment on the rest of us.
Last I checked, FBI said to just pay the ransom.
Why bother even reporting it.
When dealing with ransomware myself, I do check the FBI for decryption-keys before I start restoring from backups, but reporting?
Soon as I'm on the payroll, Hoover.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
If you file a report, is the FBI under any obligation to keep it confidential? I wouldn't trust them to stay quiet even if that was their official policy. Those guys who leaked the "Orange is the New Black" episodes somehow learned that the studio had called the FBI, after being warned not to, and punished them for doing it, even though they paid the ransom.
I read one paper by a security expert and he said that big banks in Europe and N. America have been doing this for years. Eat the losses from computer crime as a cost of doing business rather than risk damage to their reputation by reporting that someone had broken into their customer's accounts.
I'm sure a lot of other companies would rather pay up than endure the bad publicity which would come from word getting out that "Company X was hacked".
This. Ransomware executed on a desktop at my office while I was on vacation last year. It encrypted many files on the local HDD and a large fraction of the file shares. The source was soon found, cleaned up, and the affected files were restored from backups. What's worth reporting?
"When information is power, privacy is freedom" - Jah-Wren Ryel
Ransom laws get sticky so why should I report when paying them may or may not be illegal. If I report and it happens that paying the ransom is illegal then the ransom can't be paid and the FBI is slowing down recovery. If I pay the ransom to fix the problem but then report it I might get in trouble so why bother? On the other hand, If I just restore the backups I've also destroyed the evidence so Why would I report the problem?
And a /. user threatened to shoot me if I didn't shut up. They also threatened me with legal action, by sueing me in court, if I didn't shut up. Lastly they threatened to report me to the FBI. All because I said things their liberal mind didn't agree with.
Thanks to you I had to create a Python script to scrape my Slashdot comment history, making it very easy to reconstruct the events of the last three months.
I'm not sure why 5 other accounts were banned when it was YOU making death threats to other users.
File a complaint. I did and got results.
What would be the point?