On the Economics of Ransomware

Abstract

While recognized as a theoretical and practical concept for over 20 years, only now ransomware has taken centerstage as one of the most prevalent cybercrimes. Various reports demonstrate the enormous burden placed on companies, which have to grapple with the ongoing attack waves. At the same time, our strategic understanding of the threat and the adversarial interaction between organizations and cybercriminals perpetrating ransomware attacks is lacking.In this paper, we develop, to the best of our knowledge, the first gametheoretic model of the ransomware ecosystem. Our model captures a multistage scenario involving organizations from different industry sectors facing a sophisticated ransomware attacker. We place particular emphasis on the decision of companies to invest in backup technologies as part of a contingency plan, and the economic incentives to pay a ransom if impacted by an attack. We further study to which degree comprehensive industry-wide backup investments can serve as a deterrent for ongoing attacks.

Volenti non fit injuria: Ransomware and its Victims

“…Since significant financial gain continuously drives the creation and spread of ransomware [3], one of the most effective methods of combating this type of malware is cutting off the supply of funds obtained through the ransom paid by the victims. Hence, a deeper understanding of the typical victims of ransomware attacks can be very helpful in coming up with solutions that prevent or mitigate the current fastgrowing ransomware problem.…”

“…The user can only regain access if and when a sometimes-hefty "ransom" is paid, and in many instances, the access to the data is never returned to the user even if the ransom is paid in full [2]. Consequently, due to the significant financial gain ransomware can offer the perpetrators [3], considerable resources are often put behind the creation of new and innovative variants, allowing them to bypass state-of-the-art anti-virus and anti-malware software [4].…”

TEE-aided Write Protection Against Privileged Data Tampering

“…An obvious recovery-based countermeasure against malware/ransomware is to make offline backup of important data regularly (on media disconnected from the computer or with device-enforced write protection, as ransomware also attempts to erase accessible backups). Although simple in theory, effective deployment/use of backup tools could be non-trivial, e.g., determining frequency of backups, checking integrity of backups regularly (see Laszka et al [35] for an economic analysis of paying ransom vs. backup strategies). More problematically, the disconnected/write-protected media must be connected/unlocked (online) during backup, at which point, malware/ransomware can encrypt/delete the files (see [24], [41]).…”

Economics of Ransomware Attacks

“…From the perspective of consumers, the game is more complex. Laszka et al (2017) explore security investments in risk mitigation (e.g, backups) and the strategic decision of whether to pay ransom. They abstract away any preventive effort investments by consumers (patching, firewalls, etc).…”