# Ransomware: What is the alternative to paying the ransom? **URL:** \ **Category:** Factual Questions\ **Created:** [May 16, 2017, 10:18am UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731 "2017-05-16T10:18:07Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![John\_Mace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/john_mace/32/185_2.png) [@John\_Mace](https://boards.straightdope.com/u/John_Mace)\ **Post date:** [May 18, 2017, 12:38pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/21 "2017-05-18T12:38:17Z")
> [@Chronos](#): > > Eh, if they’re demanding payment in bitcoins, it shouldn’t be too long before they’re tracked down. Bitcoins are the least anonymous and most trackable currency in all of history, and I’m half-convinced that they were actually developed by some governmental three-letter agency for exactly that reason. Shhhh. Ix-nay on the EE-I-A-say!! ---
**Author:** ![Telemark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telemark/32/372_2.png) [@Telemark](https://boards.straightdope.com/u/Telemark)\ **Post date:** [May 18, 2017, 3:30pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/22 "2017-05-18T15:30:55Z")
> [@Esco](#): > > Wow, thats evil!! :eek: Effectively unbreakable encryption isn’t very hard to accomplish. ---
**Author:** ![Esco](https://avatars.discourse-cdn.com/v4/letter/e/9de053/32.png) [@Esco](https://boards.straightdope.com/u/Esco)\ **Post date:** [May 18, 2017, 4:20pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/23 "2017-05-18T16:20:01Z")
> [@Telemark](#): > > Effectively unbreakable encryption isn’t very hard to accomplis. It took DirecTV 10 years to come up with one ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [May 18, 2017, 4:47pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/24 "2017-05-18T16:47:24Z")
> [@Telemark](#): > > Effectively unbreakable encryption isn’t very hard to accomplish. It is actually amazingly hard to do in practice. The theory is one thing. To implement it right is very, very hard. E.g., people cut corners. One of the early ransomware programs simply did an xor on the files. Lots of easy ways to undo that. E.g., have an original of just one of the files? Xor that with the “encrypted” one and you have the xor key to decrypt them all. There was also one that researchers figured out the encryption pair creation algorithm enough that they provided a service to victims to send in the key the virus used and they’d provide the decryption key for free. Given that the encryption side of WannaCry isn’t from the NSA rootkit, who knows how sloppy they were on that? (They were sloppy about some other matters.) ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [May 18, 2017, 8:19pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/25 "2017-05-18T20:19:12Z")
> [@ftg](#): > > And of course it is _very_ smart to make an online purchase on a computer known to be infected. What could go wrong! Again, it’s probably fairly safe. The ransomeware criminals want people to tell genuine stories of how it was all OK when they just handed over their few hundred dollars. Their income depends on it. ---
**Author:** ![Exapno\_Mapcase](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/exapno_mapcase/32/1051_2.png) [@Exapno\_Mapcase](https://boards.straightdope.com/u/Exapno_Mapcase)\ **Post date:** [May 18, 2017, 8:28pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/26 "2017-05-18T20:28:43Z")
If a computer has its files encrypted, are those just the ones on the primary hard disk or do secondary disks, flash drives, and backup drives also encrypted? ---
**Author:** ![PastTense](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pasttense/32/14550_2.png) [@PastTense](https://boards.straightdope.com/u/PastTense)\ **Post date:** [May 18, 2017, 8:32pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/27 "2017-05-18T20:32:29Z")
> [@Exapno\_Mapcase](#): > > If a computer has its files encrypted, are those just the ones on the primary hard disk or do secondary disks, flash drives, and backup drives also encrypted? If they are connected to the computer when the ransonware executes the answer is yes. ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [May 18, 2017, 9:17pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/28 "2017-05-18T21:17:33Z")
> [@Exapno\_Mapcase](#): > > If a computer has its files encrypted, are those just the ones on the primary hard disk or do secondary disks, flash drives, and backup drives also encrypted? All physaically connected drives, all connected network drives, and often all areas to which the user can access to which the malware manages to connect. Having the malware as a Domain Admin or Enterprise Admin can be devastating. ---
**Author:** ![k9bfriender](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/k9bfriender/32/3283_2.png) [@k9bfriender](https://boards.straightdope.com/u/k9bfriender)\ **Post date:** [May 18, 2017, 9:51pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/29 "2017-05-18T21:51:45Z")
It would probably cost me more than $300 in productivity and time to rebuild all my computer databases, even though everything is backed up. But, I would rather spend a couple grand getting things back up than pay the asshole who did this to me anything. If the data was irretrievable, or if it would cost ridiculous amounts to rebuild, then I would have little choice but to pay the ransom, but I wouldn’t be happy about it. Hopefully, this attack served as a reminded to all companies to review their backup policies, and make sure that they are being properly implemented. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [May 19, 2017, 11:41am UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/30 "2017-05-19T11:41:17Z")
> [@Quartz](#): > > All physaically connected drives, all connected network drives, and often all areas to which the user can access to which the malware manages to connect. Having the malware as a Domain Admin or Enterprise Admin can be devastating. Especially since this particular one is also a worm, meaning it self-replicates (using the NSA hack). If you have any unprotected computers on that network, they directly get infected, not just their shared files. Though apparently this attack is not too stealthy about it, so maybe you could disconnect before too much damage. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [May 19, 2017, 12:08pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/31 "2017-05-19T12:08:21Z")
And there _is_ a hole in the WannaCry encryption software. [Someone](https://yro.slashdot.org/story/17/05/18/1947217/windows-xp-pcs-infected-by-wannacry-can-be-decrypted-without-paying-ransom) has figured out how to retrieve the encryption key on Windows XP (!) machines in some cases. Again, writing good encryption software is vastly harder than it looks. ---
**Author:** ![Esco](https://avatars.discourse-cdn.com/v4/letter/e/9de053/32.png) [@Esco](https://boards.straightdope.com/u/Esco)\ **Post date:** [May 19, 2017, 12:23pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/32 "2017-05-19T12:23:59Z")
> [@ftg](#): > > And there _is_ a hole in the WannaCry encryption software. [Someone](https://yro.slashdot.org/story/17/05/18/1947217/windows-xp-pcs-infected-by-wannacry-can-be-decrypted-without-paying-ransom) has figured out how to retrieve the encryption key on Windows XP (!) machines in some cases People still use Windows XP???!! :eek: ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [May 19, 2017, 12:24pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/33 "2017-05-19T12:24:25Z")
We had one fellow come in for help, several years ago with Cryptolocker, who was desperate enough to pay. However, at the time, he could not find a way to buy several hundred dollars of bitcoin within the three days. So it was a lost cause. I hear about an infection every month or two, and nobody that I know has actually paid, let alone gotten their files back. (Although I think during cryptolocker, there was a CBC report of some Canadian couple who got their photos back on their home PC by paying) I’ve seen various businesses from time to time get hit with the various versions of these viruses. Any business with about 10 or 20 computers or more usually has a central file server and a nightly backup. (Which, hopefully, is actually working) The only real solution is to restore the files from backup. I saw one installation where the encryption of the common file server share did the A’s and B’s stopped in the C’s (folder names off the root of the share). We presumed that an anti-virus definition for the virus came out while it was busy trying to encrypt the files… Restore! Typically these viruses find anything that looks like real data and encrypt it - doc(x), xls(x), pdf, jpg, ppt(x), dat, bak, msg, eml, dbf. They don’t encrypt the Windows system or programs - otherwise, your PC wouldn’t run and they’d never get their money. Also, typically they self-destruct after doing their thing, so that they can’t be analyzed to try and figure out the encryption algorithm. I saw one nasty one a few weeks ago that also seemed to have altered Windows policy to disallow logins by administrator-level users. Regardless, you have no idea what else was dumped on your PC besides the encryption program - simplest safest solution, wipe the disk and reinstall windows. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [May 19, 2017, 12:28pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/34 "2017-05-19T12:28:00Z")
> [@Esco](#): > > People still use Windows XP???!! :eek: Windows XP and Office 2003 were the last iterations, AFAIK, that didn’t phone home to activate. They will probably live forever as virtual machines. I know a huge number of businesses that still have XP sitting around doing trivial tasks; what more do you need to remote in to Terminal Server? Plus as the recent news reports also mentioned, a lot of those hand-held hardware devices like the courier companies’ “sign here” scanner devices - all run embedded XP. ---
**Author:** ![Fotheringay-Phipps](https://avatars.discourse-cdn.com/v4/letter/f/d9b06d/32.png) [@Fotheringay-Phipps](https://boards.straightdope.com/u/Fotheringay-Phipps)\ **Post date:** [May 19, 2017, 2:08pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/35 "2017-05-19T14:08:37Z")
Article in the NYT relevant to this discussion: [Victims Call Hackers’ Bluff as Ransomware Deadline Nears](https://www.nytimes.com/2017/05/19/business/hacking-malware-wanncry-ransomware-deadline.html?_r=0) ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [May 19, 2017, 4:22pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/36 "2017-05-19T16:22:34Z")
There was a classic cartoon that used to be part of an advertisement on the back page of Computerworld in the 1980’s - Everyone is standing around the grave, the priest is saying something over the coffin, and one fellow is say to the widow “I know this is a bad time, but did he ever mention anything about backups?” Can’t emphasize enough how important it is to make backups. All your photos nowadays are kept on your PC. So is your music, your correspondence, your tax returns, etc. Copy to a backup USB stick or disk. UNPLUG THAT, and store it offsite or somewhere safe (I give mine to my inlaws when we go on trips). Refresh it every few weeks. Ransomware is the least of your worries - there’s also fire, theft, natural disasters, etc. or even simple hard disk failure to worry about. ---
**Author:** ![Machine\_Elf](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@Machine\_Elf](https://boards.straightdope.com/u/Machine_Elf)\ **Post date:** [May 19, 2017, 4:54pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/37 "2017-05-19T16:54:04Z")
> [@md2000](#): > > Can’t emphasize enough how important it is to make backups. All your photos nowadays are kept on your PC. So is your music, your correspondence, your tax returns, etc. Copy to a backup USB stick or disk. UNPLUG THAT, and store it offsite or somewhere safe (I give mine to my inlaws when we go on trips). Refresh it every few weeks. Ransomware is the least of your worries - there’s also fire, theft, natural disasters, etc. or even simple hard disk failure to worry about. This. I have an external hard drive velcroed out of sight underneath my desk, and every couple of weeks I plug it in and backup my files (and then disconnect it); if my PC gets stolen or blasted by lightning, this will save my bacon. I have another external hard drive in a fireproof safe bolted to a shelf in the basement, and every few months I plug it in and backup my files; if the house burns down or gets blown away by a tornado, this will save my bacon. It’s also in a zip-loc bag to prevent any smoke or water damage (the latter not from flooding, but from firefighting efforts). My brother mentioned a friend of his who interviews prospective employees. One of the questions he asks during these interviews is “what’s your PC/Mac backup strategy?” The ones who don’t answer “uh…none” are given stronger consideration over those that do. 😃 ---
**Author:** ![Pantastic](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@Pantastic](https://boards.straightdope.com/u/Pantastic)\ **Post date:** [May 19, 2017, 5:59pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/38 "2017-05-19T17:59:35Z")
> [@ftg](#): > > Again, writing good encryption software is vastly harder than it looks. What confuses people is that writing an encryption algorithm that is completely impractical to break is easy to do, it’s something you can do in a first-year programming class. Coming up with a way to encrypt files that would take a thousand years of supercomputer time to reverse is not a hard exercise, and a one-time pad system is theoretically unbreakable if you don’t have the ‘pad’! What’s actually difficult is making a good encryption implementation, that is figuring out how to encrypt and decrypt files when you want to, and how to do it quickly enough to be practical, and how to handle keys so that you don’t actually lose the data but also so the ‘hacker’ can’t easily get a hold of them. For ransomware, it would be fairly trivial in theory to generate a completely random key, encrypt all of the files, and send the key back ‘home’ to a central database, then release it when the victim pays. But it gets more complicated in practice, because it’s possible for the call home not to work, to lose track of which key goes to which files, for someone to catch the key before the call home finishes, and a host of other failure cases. Plus maintaining a giant database like that is a lot of work. So (like with any security problem) they’ll take shortcuts and do ‘imperfect’ implementations, by doing things like trying to hide the key locally, or using a non-random algorithm to generate keys (so they can figure out what the key was if it’s lost), or something else along those lines. This is how people are able to figure out what the keys are, or automatically generate a key to decrypt files. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [May 19, 2017, 6:04pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/39 "2017-05-19T18:04:07Z")
> [@Chronos](#): > > Eh, if they’re demanding payment in bitcoins, it shouldn’t be too long before they’re tracked down. Bitcoins are the least anonymous and most trackable currency in all of history, and I’m half-convinced that they were actually developed by some governmental three-letter agency for exactly that reason. Huh. I always thought they had the allure of _not_ being as traceable. “Give me $50,000 in unmarked non-consecutive Bitcoins.” ---
**Author:** ![Pantastic](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@Pantastic](https://boards.straightdope.com/u/Pantastic)\ **Post date:** [May 19, 2017, 6:16pm UTC](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731/40 "2017-05-19T18:16:46Z")
> [@Leo\_Bloom](#): > > Huh. I always thought they had the allure of _not_ being as traceable. Oh that’s part of their allure, it’s just not an actual property of Bitcoin. It’s incredibly, completely traceable and the complete history of all transactions is shared as a base part of the protocol. You can make ‘wallets’ which theoretically don’t have any connection to a real person, but at some point in the chain of transactions you’ll have to convert from bitcoins to real money, and that nails down a real identity for the transactions. If you didn’t buy bitcoins or cash them out to real money or use them to buy any real goods or services you could be anonymous, but that’s kind of useless. [Previous page](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731.md?page=1) [Next page](https://boards.straightdope.com/t/ransomware-what-is-the-alternative-to-paying-the-ransom/786731.md?page=3)