Paying the Ransom Demand of a Hacker

Wired Magazine had a snippet regarding hackers making demands of unsuspecting Webmasters. How it often times works is the hacker will notify the Webmaster that a vulnerability has been discovered on their site and for a “consulting fee” of something nominal … around $1,500.00 usually, is requested or the vulnerability will be posted.

What should you do?

If you pay the “ransom” what is to keep the hacker of posting the vulnerability anyway? Or since you paid once, you’ll probably pay again and they’ll get their buddies in on the scam and hit you for more money. When will it end? Probably when you stop paying.

What is the risk of just ignoring the demand? Not much. According to the FBI, most of these demands are merely bluffs, and the vulnerabilities they may have discovered can cause little harm to your site. According to a survey conducted in 2004, only 18% of these types of ransom demands were real.

But since that is still a 1-in-5 chance of getting your site nailed, you can begin “negotiations” with the hacker as you alert your web host to check and validate the vulnerability. This extra time can help you “lock down” your site so the vulnerability can be corrected and the ransom doesn’t have to be paid.

Many ask me about HackerSafe. It used to be a good service, but since McAfee bought them, they are suspect at best and based on my testing, nearly all vulnerabilities found are false.