Why the FBI is wrong: you should never pay ransomware

Paying up can be pointless, especially when you can safeguard your data

ProtonMail, a Swiss-based encrypted email service provider, knows all too well about the futility of paying a ransom.

It did precisely that this month in order to stop a DDoS attack that was crippling its networks and those of some upstream providers. However, despite coughing up the 15 bitcoins (about 3,750) ransom the DDoS continued. I mention this as it is a great reminder that the bad guys are called 'bad' for a reason: expecting them to be reasonable and do what you perceive as the right thing following the payment of a ransom is, frankly, naive in the extreme.

Yet just last month, FBI agent Joseph Bonavolonta told delegates at a security conference that "we often advise people just to pay the ransom" when it comes to ransomware.

While this seems like a crock of the first order, some have suggested there is sense in the advice. The argument being, from a purely business perspective, one has to ask whether the time and money spent trying to free your data from the encrypted clutches of well written ransomware will be more or less than just paying the ransom and moving on.

The truth of the matter, as the ProtonMail example highlights, is that you can't actually trust the bad guys, so paying any ransom is always going to be a gamble. The FBI advice is about as useful as a one-legged man at an arse-kicking party.

When it comes to paying a ransom to decrypt your data, the odds are stacked against you in my experience. How so? Well, quite apart from the trust issue (and yes I am banging on about that, for a very good reason) there's the coding issue.

Take the Power Worm ransomware that was spotted doing the rounds recently - it was so badly coded that the attackers couldn't decrypt your locked up data even if you paid the release fee and they wanted to. Why so? Well, this variant was so full of bugs that it effectively destroyed the keys required to decrypt data.

Not that all ransomware code is a pile of crap. The latest iteration of Cryptowall, for example, appears to be pretty well written, and has tweaked the encryption process and the way it evades detection in the first place. This is probably why the folk behind Cryptowall have raked in ransoms in the order of hundreds of millions of pounds, according to the Cyber Threat Alliance.

So, going back to our FBI man and his advice, should you pay the ransom? And is paying up the only way to deal with this type of ransomware? My answer is always going to be no. A big fat no, in fact. The most effective way to deal with ransomware is with a pre-emptive twin-pronged strategy that involves not getting infected and having suitable data backups just in case you do.

In terms of prevention, ensure you are using endpoint protection that's up to date so as not to get hit with old threats. Ditto as far as system OS patches and application updating are concerned: the smaller your insecurity footprint, the less opportunity for the bad guys to strike.

Advertisement - Article continues below
Advertisement - Article continues below

This is why staff training and awareness also plays into this, with phishing/social engineering techniques being another common route to infection. In fact, when it comes to ransomware infection mitigation we are talking the same old, same old. Don't open files attached to unsolicited emails, don't click on untrusted links, yada yada yada.

The target of these attacks is your data, but rather than attempts at exfiltration, the attackers want to lock it down and stop you accessing it, so you need to focus on that as well. The solution is simple enough: back it up. More to the point, have a backup strategy that involves multiple backups (local and cloud) which include 'air-gapped' ones so as not to all be hooked into the same computers and networks that might get infected.

Minding the gap means that if the worse did happen you can simply wipe things clean and start again where you left off. Hopefully. Erm, I should mention that there are some ransomware variants which stealthily encrypt or decrypt data on-the-fly, in the background, for weeks or months on end, so that your backups are actually also encrypted and worthless.

However, not going into panic mode post-infection is a good move. You might be surprised just how much information is out there to help you remove a ransomware threat and decrypt your data.

Some ransomware malware has already been reverse-engineered, and decrypting tools are available to unlock your data without any ransom being paid. Google is your friend, as are open-source threat intelligence depositories like VirusTotal, so do your research and find out what has attacked you and whether anyone has already dealt with it.

If all else fails though, rather than pay the ransom, instead consider paying a security consultant to help you. It means you stand more chance of recovering your data, and at least your money is going to the good guys...

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now



How can you protect your business from crypto-ransomware?

4 Nov 2019

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019

Best free malware removal tools 2019

23 Dec 2019
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020