The only folks not fed up with it are the criminals that are getting paid.

I've seen a few kidnapping movies in my time and I can't understand why ransoms aren't outlawed (unless they are, and the movies pretend otherwise). I guess the government wants to make sure that people keep talking to the police?

It's strictly illegal for corporations to pay bribes or kickbacks to facilitate their business operations. Congress could easily extend those laws to make paying ransom illegal as well.

just make it illegal to pay the ransom. Companies have calculated good security costs more than paying the ransoms. The only fix to that is to fine them more for paying the ransoms than not.

But we don't actually treat white collar corporate crime like a crime, let alone have enough white collar cops (aka "bureaucrats") to enforce it if we did.

THEN MAKE IT ILLEGAL TO PAY THEM. If there's a zero chance you're getting paid in a certain country, you're not going to attack that country for money. It's that damn simple. Oh noooo, irreplaceable data! You're sunk without it. FUCK YOU! Ggo out of business, you morons. Sincerely, a better IT technician in a better prepared IT department at a better company.

First up, why do ISPs not give an option to just blanket block e-mails and even connections from other regions? If you want to allow them, your ISP can have settings to open up connections from various places, but for the majority of people and companies, are you doing business from Nigeria, or even for smaller businesses, if you aren't involved or interested in doing business outside of your own country, wouldn't you feel safer if your ISP were just blocking all traffic from other countries? I know tha

Seriously. I have over 200 Digital Ocean/Azure/AWS/etc IP blocks already and it continues to grow.

With cloud automation, it's trivial to spin up infrastructure, spew the campaign, grab the necessary then simply dissolve it all.

Cloud vendors have to become part of the defense-in-depth solution or we will remain farked.

Just sanction all crypto exchanges. The moment the US cuts off crypto from the financial system it's dead and ransomware with it.

Ransomware solved. Gigawatts of power saved. Win win.

If it's infrastructure, don't connect it to the internet.

If it's internet connected business hardware/software, 3-2-1 backups, and a real capable on staff administrator.

If it's lifesaving must-be-connected-to-save-the-life gear, keep a spare on-hand and disconnected.

If it's consumer IOT lightbulb vacuum washing machine surveillance silliness, make better buying decisions in the future.

It's crazy how this is still such a problem. I've personally guided multiple business through ransomware infections. It's no

I used to run the IT security program at a large multinational business that dealt with a really nasty chemical. The fact that we dealt with that chemical forced us to be brought under the Homeland Chemsec level 2 tiered site and we had to submit to audits by Homeland security. The auditing that audited us said I did the best on the initial audit of any company they had ever audited. The ONLY things that I got dinged on, I had proof that I had attempted to put in place but got over ridden by executive levels. Simple things like PC lockdowns that existed on every other machine in the org but fucking entitled execs refused to allow to happen to their own machines. Things like delivery times and every PC that had data that showed deliveries, storage, personnel all had to be very tightly controlled. Executive levels were privvy to that and had it on their laptops. We got dinged for it in the audit, but NOTHING HAPPENED with of any substance. Executive levels are the WORST security issues in most companies and no one does a thing about it. Security teams warn them. Nothing. External audits... nothing. Security really isn't as hard as people make it out to be. A 100% whitelist based system where nothing new works and everything has to be vetted and approved in advance actually makes IT security fairly simple and cheap. It's only when you have to cater to employee "happiness" that things go off the rails. In IT security, happiness is irrelevant. Configure every single machine in the company to be able to do the pre-defined and assigned job function and anything other than that should fail and you can have cheap and simple security system. But that never happens fully because employee happiness is a consideration above security and that should NEVER be the case.

The fuckers that pay did try to go cheap before and basically asked for it. There really is no sane way to see these organizations as "victims" at this time. They are perpetrators that make things worse, nothing else.

It needs to be decided and voted on by Congress, not an unelected bureaucracy.

Just start up BuSab, Frank Herbert's bureau of sabotage, only have it attack domestic businesses. Of course, it would provide the victims (and after a delay everyone else) with details on how it successfully attacked with what should have been done to prevent that, and it wouldn't exploit customer data, just prevent the company from having access to it. And, it would attack relentlessly, so that no company could afford to continue operating with shitty security. Additionally, continue with fining companie

If you incentivize criminals to steal that they would keep doing it. You paid them, they should stop right? Is that how that works?

That will force companies to make sure they have proper backups, which is the correct solution to a ransomware attack.

Isn't it illegal to give money to enemies of the state?

If those paying ransoms are funding enemies of the state, aren't they committing federal offenses?

Not an American, so maybe have this mixed up...but that's my impression.

The devil on my shoulder is telling me to start spreading cryptolocker malware and then not sending the unlock key after payment. I'll make businesses across the country safer (in the long run) while also getting rich!

Let me suggest that the problem is people are a busing the internet by using it for things it is not capable of securely supporting. As long as you are connected to the internet you are going to be vulnerable. The answer is to get off the internet. Demanding a 100% security is impossible but the more valuable the service you offer the bigger the reward from ransomware. You aren't going to pay $1000 ransom because your kids phone is bricked.

...so you can weaponise them in your fight against witnesses, whistleblowers, journalists, politicians and activists.... or whatever country is the latest victim of your out of control foreign policy. how many times does it take them being used before responsible behavior becomes the norm?

have watched the sheer idiocy of the policy evolve over the decades, and it's clear that 'surveil everything' has taken precedence over 'secure everything'.