To pay or not: game theoretic models of ransomware

Abstract

Ransomware is a type of malware that encrypts files and demands a ransom from victims. It can be viewed as a form of kidnapping in which the criminal takes control of the victim’s files with the objective of financial gain. In this article, we review and develop the game theoretic literature on kidnapping in order to gain insight on ransomware. The prior literature on kidnapping has largely focused on political or terrorist hostage taking. We demonstrate, however, that key models within the literature can be adapted to give critical new insight on ransomware. We primarily focus on two models. The first gives insight on the optimal ransom that criminals should charge. The second gives insight on the role of deterrence through preventative measures. A key insight from both models will be the importance of spillover effects across victims. We will argue that such spillovers point to the need for some level of outside intervention, by governments or otherwise, to tackle ransomware.

Game Theory of Data-selling Ransomware

“…While kidnapping and blackmail is typically in a terrorist context [23], ransomware may be modeled as kidnapping. The kidnapping aspect of ransomware was acknowledged at a practical level and the models of hostage were extended to study the role of irrational aggression and crime deterrence [11]. The game theoretic literature on kidnapping and blackmail gives insight on the optimal ransom that criminals should charge and the role of deterrence through preventative measures.…”

A Roadmap for Improving the Impact of Anti-ransomware Research

“…Additionally, many cybercriminals simply make use of the code or ideas from other relatively successful ransomware variants in order to make a quick profit [5] [6]. Also, the availability of Ransomware-as-a-Service (RaaS) [7] means cybercriminals can go to the underground market to purchase ransomware kits, such as Satan [8], allowing them to deploy their own ransomware variants without needing in-depth technical knowledge.…”

Economics of Ransomware Attacks

“…In contrast, in our study, in the case of untargeted attacks with lateral movement, preventive actions effectively impact the spreading of the attack. Cartwright et al (2018) adapt the models by Lapan and Sandler (1988) and Selten (1988) to ransomware attacks and explore bargaining and deterrence strategies. In particular, they show that the likelihood of irrational aggression in the absence of payment and credible commitment to return files upon receipt of payment play key roles in incentivizing victims to pay the ransom.…”

“…Last but not least, neither the kidnapping literature nor the extant literature on economics of ransomware capture the possibility of negative security network externalities which characterize worm cyberattacks. Cartwright et al (2018) mention potential spillover effects of deterrence when there are two customer categories but they do not tie these effects to the size of the vulnerable population. In the case of worm ransomware, due to autonomous lateral spreading, the higher the number of unpatched systems on a network, the higher the risk of infection to every single one of them.…”