Timeline for I got an email threatening to DDOS me if I don't pay a ransom. What should I do?
Current License: CC BY-SA 3.0
45 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 8, 2016 at 13:11 | comment | added | Suici Doga | Their a bunch of idiots to put a LMGTFY URL since it shows that they are hackers (the URL is there on the CloudFlare blog) | |
| Jun 22, 2016 at 7:13 | comment | added | Nighthunter22 | Did you get DDos'ed? Or it was fake? I'm just asking because we got the same email and since I read this before, I just knew that was a fake threat. | |
| Jun 4, 2016 at 22:29 | history | protected | CommunityBot | ||
| May 11, 2016 at 20:09 | comment | added | Jason | @Nateowami Ah, yes, now I get what you're saying :) | |
| May 11, 2016 at 14:51 | comment | added | Nateowami | @Jason That wasn't my point, but I see what you're saying now. My point was that they will never know if you pay or not. Hence, anyone that sees that people pay, should also realize that everyone who paid was tricked, because the scammer can't even tell who is paying and who isn't. See this comment. | |
| May 11, 2016 at 13:40 | comment | added | Jason | @Nateowami "priming the pump is useless because you can't see who sent the money, therefore because they have money in their wallet I believe they've actually been paid" - which is exactly the conclusion that priming the pump is supposed to help you reach. | |
| May 11, 2016 at 6:26 | comment | added | candied_orange | I find myself wondering how much CloudFlare paid to be mentioned in this email. I mean DDoS attacks are bad and all but wow ads are getting aggressive. | |
| May 11, 2016 at 1:18 | comment | added | Nateowami | @Jason I don't understand what you're getting at. How is my logic circular? While I agree priming the pump is unnecessary, my point is that it doesn't help them at all. Anyone who checks the ledger and sees that they have been paid should also realize that because they reuse addresses there is no way for them to know who pays. A real DDoSer would not reuse addresses. | |
| May 10, 2016 at 13:54 | comment | added | Jason | @Nateowami that's some fairly circular logic. Here's some straightforward logic: this is more "legitimate" than a nigerian prince scam, and people fall for those all the time. I have zero doubt that they have gotten paid. | |
| May 10, 2016 at 8:12 | answer | added | Kevin | timeline score: -1 | |
| May 8, 2016 at 16:18 | vote | accept | alexw | ||
| May 8, 2016 at 13:20 | comment | added | Nateowami | @alexw True, but by the time you see that "people are paying" you've already seen that "they can't tell who pays" and "Bitcoin isn't as anonymous as they claim." Hence, I think they probably actually got paid that money. Or else they're really that dumb and didn't think it all though... | |
| May 8, 2016 at 0:54 | comment | added | Pedro Lobito |
Amateurs...lmgtfy URL here
|
|
| May 6, 2016 at 19:57 | comment | added | dr_ | This looks like the assassination threat spam: sophos.com/en-us/press-office/press-releases/2007/01/… | |
| May 6, 2016 at 16:39 | history | edited | alexw | CC BY-SA 3.0 |
update
|
| May 6, 2016 at 16:33 | comment | added | alexw | @Ant it would make it seem like other people are paying the ransom. So, I might be more likely to think the threat is real and pay if I see other people paying. | |
| May 6, 2016 at 16:09 | answer | added | Pepijn Schmitz | timeline score: 7 | |
| May 6, 2016 at 10:17 | comment | added | Ant | @alexw what purpose would that serve? | |
| May 5, 2016 at 21:52 | comment | added | alexw | @AlexanderO'Mara it is also possible that they are "priming the pump" by sending money to their own BTC addresses. | |
| May 5, 2016 at 21:04 | comment | added | Alexander O'Mara | The really scary thing here is that this actually appears to be working (based on looking up some of the BTC addresses used in these emails, because bitcoin is not that anonymous), meaning there are people gullible enough to believe this and pay in charge of some of these companies. | |
| May 5, 2016 at 18:19 | history | edited | D.W. | CC BY-SA 3.0 |
added 26 characters in body
|
| May 5, 2016 at 17:14 | comment | added | wizzwizz4 | Your DDoS system was broke? No wonder you didn't pay; your DDoS system couldn't afford it! | |
| S May 5, 2016 at 16:30 | history | mod moved comments to chat | |||
| S May 5, 2016 at 16:30 | comment | added | schroeder♦ | Comments are not for extended discussion; this conversation has been moved to chat. | |
| May 5, 2016 at 15:36 | comment | added | alexw | Since I'm CEO and CTO, I held a brief meeting in my head, which went like this: CEO: "Hey Alex, should we pay the ransom?" CTO: "Hell no." CEO: "But what if they make good on their threat?" CTO: "So what? We don't make enough money that it would matter. Also, I'd rather spend the $4K on mitigation and/or <insert vice of choice>. Also, screw those guys." CEO: "Oh, right." | |
| May 5, 2016 at 14:26 | comment | added | Dennis | Did you fix your DDoS system? | |
| May 5, 2016 at 14:10 | comment | added | Sebb | I just love the part where they were asking your customer service for the ransom. I can easily imaging it: "Hey, we recently DDOS'ed your company and didn't yet receive our payment. Could you forward this to your management, please?" | |
| May 5, 2016 at 12:59 | answer | added | Steve Jessop | timeline score: 3 | |
| May 5, 2016 at 12:39 | answer | added | athena | timeline score: 5 | |
| May 5, 2016 at 11:05 | comment | added | Teun Vink | Several of my customers have received identical threats, no DDoS'es have been observed. Bottomline: don't pay, contact local law enforcement agencies (extortion is a criminal offense in most countries at least), and make sure you have procedure for dealing with attacks ready (which have you should in any case). | |
| May 5, 2016 at 10:21 | comment | added | edmeme | Maybe they meant 1 tablespoon (tbsp) per second. | |
| May 5, 2016 at 10:09 | answer | added | Damian | timeline score: 18 | |
| May 5, 2016 at 9:33 | comment | added | user | @JamesTrotter At 1 Tbps/s, how long until they saturate the worldwide Internet? I don't know what the global available bandwidth is, but would hazard a guess that we'd be looking at Pb/s range figures. So at that rate, they would saturate the Internet in maybe an hour. If the threat was true as written, also origin ISPs would scramble to stop them if only to save their own bottom line. | |
| May 5, 2016 at 8:40 | answer | added | David Glickman | timeline score: 54 | |
| May 5, 2016 at 8:16 | history | edited | Mike Ounsworth |
the [ransomware] tag should be used for the encrypting-your-data type of malware
|
|
| May 5, 2016 at 8:10 | comment | added | James T | @HagenvonEitzen Not only is it a fast attack... its accelerating | |
| May 5, 2016 at 7:49 | comment | added | SamBC | The company I work for was "accosted" by these guys a few months back. They did actually DDoS the site for 30 minutes, and then they started contacting our customer service inbox asking for the bitcoin ransom. Turns out, our DDoS mitigation system was broke, so they actually did us a favour! They kept sending the threatening e-mails for about two weeks, but we just called their bluff and ignored them. I still read the e-mails sometimes and laugh about it, management actually held a meeting to consider paying these guys! | |
| May 5, 2016 at 6:57 | comment | added | Hagen von Eitzen | @CodyP 1Tbps is already a lot, then what is 1Tbps per second? | |
| May 5, 2016 at 6:20 | comment | added | RealAnswersNotAI | I agree that the claim sounds fishy. Getting around Cloudfare and doing a 1 Tbps attack would be a newsworthy attack (I think the largest recorded was 400 Gbps back in January 2016). Not something you would be going to small companies and making $4000 dollar threats about. | |
| May 5, 2016 at 3:45 | history | tweeted | twitter.com/StackSecurity/status/728068173396774912 | ||
| May 5, 2016 at 1:17 | comment | added | Anders | I would say get behind CloudFlare (and change and hide your real IP). While the email is probably fake and you probably wont get DDOSed, it never hurts to get some protection. When they say that they can pass CloudFlares protection they are probably lying. After all the 1 Tbps claim looks like a lie to me, so this is not very honest people... | |
| May 5, 2016 at 0:26 | comment | added | Rápli András | I've heard about this group in particular. They never actually ddos anyone. | |
| May 5, 2016 at 0:13 | answer | added | Trey Blalock | timeline score: 99 | |
| May 5, 2016 at 0:12 | answer | added | schroeder♦ | timeline score: 107 | |
| May 5, 2016 at 0:09 | history | asked | alexw | CC BY-SA 3.0 |