11

Typically, ransomware will encrypt the victim's files and ask for money in exchange for the decryption key.

If you do pay the ransom, does it actually deliver on this promise? It seems to me that having employed the ransomware in the first place, the operator has already proven himself unreliable and willing to act in bad faith. Once you do pay the money, what's stopping him from simply disappearing without giving you the key?

Why even have the key in the first place, when you can just delete the files (or overwrite with random data) and then claim they are encrypted when asking for money?

  • 2
    As @PriyankGupta said in his answer, they may provide a key in order to "cultivate customers loyalty" (for the same reason I was also surprised that medication spams really ended with an actual product to be shipped and delivered). However nothing prevents them for doing other nasty with your payment (charging you several times, trying to rob your banking information, etc.) while still delivering the keys... – WhiteWinterWolf Aug 8 '15 at 8:55
  • @WhiteWinterWolf Well, that sounds a bit like a mugger taking your phone and wallet, but then "graciously" giving you $10 for a cab home. – Superbest Aug 8 '15 at 16:21
  • BTW, I would actually be interested to know how common genuine ransomware is. From what I understand, many ransomwares aren't ransomware at all; they just pretend to be ransomware and hope the victim believes the deception. – Superbest Aug 8 '15 at 16:26
  • 3
    Or more frequent case: the ransomware is still out there, contaminating new computers, but the attackers have already drop down any channel which could link them to it, including the payment system, after a month (for instance) of activity. A sort of "Sorry, but your ransomware is not supported anymore" story. As per statistics, I sadly do not know any stats regarding such subjects, I do not know either if any stats are really doable (at best it would be estimates). – WhiteWinterWolf Aug 8 '15 at 17:23
  • 3
    @Superbest In some twisted sense, those fake ransomwares are actually better because they cause people not pay in the future and therefore render ransomware nonviable. – Tomáš Zato Apr 13 '16 at 14:54
10

While other answers state that it makes sense for the malware authors to deliver on their promise to decrypt your files (I agree, it does) they offer no evidence. Anecdotal evidence is the best you'll get in the case, but it is not unheard of that the criminals will actually decrypt your files for you.

This New York Times article details how the author's mother's computer became infected with ransomware. Here are some selected sections to answer your question:

Of course, this advice arrives too late for my mom. And it appeared her payment had arrived too late as well: By the time I got home from Greenpoint, her CryptoWall ransom had been raised to $1,000, and the $500 in Bitcoins she had deposited had vanished. In a panic, she wrote to Mike Hoats asking for advice. What he told her sounded crazy to me. Use the CryptoWall message interface to tell the criminals exactly what happened. Be honest, in other words.

So she did. She explained that the virus had struck the same week that a major snowstorm hit Massachusetts and the Thanksgiving holiday shut down the banks. She told them about the unexpected Bitcoin shortfall and about dispatching her daughter to the Coin Cafe A.T.M. at the 11th hour. She swore she had really, really tried not to miss their deadline. And then a weird thing happened: Her decryption key arrived.

But Mr. Wisniewski had a more pragmatic take. “From what we can tell, they almost always honor what they say because they want word to get around that they’re trustworthy criminals who’ll give you your files back.”

Welcome to the new ransomware economy, where hackers have a reputation to consider.

Additionally Dark Reading cites two additional cases of police departments paying the ransom, and getting their files back.

However keep in mind, there are many types of ransomware written by many different programmers with varying level of skill. Some will simply not give you a decryption key, and I image some botch their whole malware and can't offer decryption keys. Other cases have been known in which the decryption key is stored on the victims computer, and you can recover your files without paying anything(example).

  • When I used the word "support" for such kind of software in my comment above, I did not imagine I could be so true. Very nice story! (and a very strange world we are living in...) – WhiteWinterWolf Aug 8 '15 at 20:12
  • Not only reputation towards customers, but also reputation towards other "hackers". If I wrote ransomware, I would want to be known as a technically adept but fair person; not as a technically adept asshole. – Stephan Bijzitter Dec 8 '16 at 13:07
6

Well, it makes sense to deliver the key on payment.

If they simply disappear, no one will trust them in future. If they keep delivering the keys on payment, and the ransomware keeps infecting people's machines, people will continue to pay for their data(if the data is so important to them). Had they simply disappeared without providing the key, and if ransomware were to attack someone's machine, the owner of that machine won't pay any money, thinking that the data is already lost. In short, the "business" of ransomware would come to an end.

If they delete the data or overwrite it with some random stuff, again, the owner of the data won't be able to retrieve the data again, even on payment.
In a nutshell, you can think of data as a hostage held by some person. As soon as the victim pays the money(in some cases, within stipulated time), he/she gets his/her data back.

  • 2
    We all agree that this makes sense, but cyber criminals aren't known for doing what's "best for the group". The question is more "why haven't hackers started taking the spam mail approach to ransomware - flood the internet with badly-written ransomware that is purely scare-ware, and if even 0.1% of infected people pay then you're doing well." -- I agree with the OP that I'm surprised that we haven't seen this yet. – Mike Ounsworth Aug 8 '15 at 4:54
  • Firstly, I think infecting people's machines with ransomware is not as easy as sending spam mail. Secondly, If the criminals stop giving the key, people would stop paying them ransom. And then the whole intention of ransomware would come to an end. Thridly, even if 0.1% people pay, that would be a one-time thing. Soon people will become aware that they won't get their data back, and no one would pay a penny. – pri Aug 8 '15 at 5:08
  • "even if 0.1% people pay, that would be a one-time thing." -- I agree that that's best for the hackers as a whole and the well-written ransomwares will do that, but you're missing my point; I'm surprised that we aren't seeing more hackers trying to make a quick lazy buck. -- maybe we are, but that's all getting caught by anti-virus software. – Mike Ounsworth Aug 8 '15 at 5:12
  • Well, agreed. Maybe they are, but I guess it takes a lot of expertise to bypass antivirus software. And the hackers trying to make a quick lazy buck may not have the required expertise. Those badly written codes might be getting filtered out be AV software, without our knowledge. – pri Aug 8 '15 at 5:18
  • 3
    I second @MikeOunsworth 's objections. Clearly, in absence of branding, it comes down to the tragedy of the commons. Cyber criminals often demonstrate lack of concern for the commons. As such, I disagree that it makes sense to deliver the key. – Superbest Aug 8 '15 at 16:19
1

There is no certain answer on whether they provide the decryption key or not. Maybe they are somewhat honest thieves/criminals.

Deleting the files would not be a reasonable approach by the ransomware as they would not have leverage. I have not yet heard of honest cyber-criminals and I don't think it would be necessary for them in order to have success. All they need is a small percentage making the payment.

The whole question boils down to one point, when are people willing to pay? All it needs are very desperate people wanting to save important data. I doubt that those people who do pay are able to make an objective decision in that situation.

They could indeed overwrite the file with random data instead of encrypting it, but encrypting it not much more complicated than overwriting. Here it might be indeed either the intention to potentially decrypt the data or the psychological effect as their victim might think that there still is hope to get it decrypted. With out that effect their "revenue" could sink.

tl/dr; I don't think the success of ransomware for the cyber-criminals has anything to do with honesty.

  • Well, the victim would think there is hope of decryption regardless of whether you actually encrypt or just overwrite, since they don't have access to the source code. Even if the files were outright erased, the average computer user would probably be unable to deduce that decryption is impossible since the data is gone. As such, we can assume most victims simply trust the attacker when he says it can be decrypted... If so, why does the attacker bother being truthful? – Superbest Aug 8 '15 at 16:24
  • @Superbest yes that point is valid. But anyway I still don't think being truthful or honest would be an advantage for the attacker, they are still likely to find a victim which is paying the ransom. And I don't think it would boost their "revenue" if they would actually decrypt the data. Unless they start a big PR action, but I haven't seen malware advertisement yet. My point about actually using encryption rather than overwriting is, that Security Researches analyzing it would see it encrypts, so if it makes into the press, it could be good (?) PR for them. Though that is highly questionable – John Aug 8 '15 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.