<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-AU;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>We have had some customers pay and some customers suck it up, some have lost data and some have recovered from backups, Skeeve is right, you can’t really comment on this until it’s your business and your data.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Whilst I implicitly don’t agree with paying criminals, when your business would suffer serious issues because a backup failed or you didn’t have one then paying $500 or so in bitcoins is a worthwhile loss when comparing the alternatives.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Regards<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Paul<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> AusNOG [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Skeeve Stevens<br><b>Sent:</b> Friday, 23 September 2016 8:26 AM<br><b>To:</b> Robert Hudson<br><b>Cc:</b> <ausnog@lists.ausnog.net><br><b>Subject:</b> Re: [AusNOG] Ransomware...<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>This is from the perspective of someone who hasn't been held to ransom, had their business at risk, and had no other choice.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The few here who say they wouldn't pay are the same... wait till it is your only choice.<o:p></o:p></p></div></div><div><p class=MsoNormal><br clear=all><o:p></o:p></p><div><div><div><div><div><div><div><div><div><div><div><div><p class=MsoNormal><span style='font-size:9.5pt'><br>...Skeeve<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.5pt'><o:p> </o:p></span></p></div><div><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Skeeve Stevens - Founder & The Architect</span></b><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> - eintellego Networks Pty Ltd</span><span style='font-size:9.5pt'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Email: </span><span style='font-size:9.5pt'><a href="mailto:skeeve@eintellegonetworks.com" target="_blank"><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>skeeve@eintellegonetworks.com</span></a></span><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> ; Web: </span><span style='font-size:9.5pt'><a href="http://eintellegonetworks.com/" target="_blank"><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>eintellegonetworks.com</span></a><o:p></o:p></span></p></div><div><p style='margin:0cm;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>Cell +61 (0)414 753 383 ; Skype: skeeve ; LinkedIn: <a href="http://linkedin.com/in/skeeve" target="_blank">/in/skeeve</a> ; Expert360: <a href="https://expert360.com/profile/d54a9" target="_blank">Profile</a> ; Keybase: <a href="https://keybase.io/skeeve" target="_blank">https://keybase.io/skeeve</a><o:p></o:p></span></p></div></div></div></div></div></div></div></div></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Fri, Sep 23, 2016 at 7:06 AM, Robert Hudson <<a href="mailto:hudrob@gmail.com" target="_blank">hudrob@gmail.com</a>> wrote:<o:p></o:p></p><p>Are you serious?<o:p></o:p></p><p>You're validating their business model. And showing that you'll likely pay again when (not if) they do you again.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 23 Sep 2016 3:04 AM, "Skeeve Stevens" <<a href="mailto:skeeve%2Bausnog@eintellegonetworks.com" target="_blank">skeeve+ausnog@eintellegonetworks.com</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal>What's wrong with negotiating? I've had a couple of customers talk down Ransomware attacks to about half the price.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>If you need the data (no backup, can't restore), what's the harm in asking?<o:p></o:p></p></div></div><div><p class=MsoNormal><br clear=all><o:p></o:p></p><div><div><div><div><div><div><div><div><div><div><div><div><p class=MsoNormal><span style='font-size:9.5pt'><br>...Skeeve<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.5pt'><o:p> </o:p></span></p></div><div><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Skeeve Stevens - Founder & The Architect</span></b><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> - eintellego Networks Pty Ltd</span><span style='font-size:9.5pt'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Email: </span><span style='font-size:9.5pt'><a href="mailto:skeeve@eintellegonetworks.com" target="_blank"><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>skeeve@eintellegonetworks.com</span></a></span><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> ; Web: </span><span style='font-size:9.5pt'><a href="http://eintellegonetworks.com/" target="_blank"><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>eintellegonetworks.com</span></a><o:p></o:p></span></p></div><div><p style='margin:0cm;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Calibri","sans-serif";color:black'>Cell +61 (0)414 753 383 ; Skype: skeeve ; LinkedIn: <a href="http://linkedin.com/in/skeeve" target="_blank">/in/skeeve</a> ; Expert360: <a href="https://expert360.com/profile/d54a9" target="_blank">Profile</a> ; Keybase: <a href="https://keybase.io/skeeve" target="_blank">https://keybase.io/skeeve</a><o:p></o:p></span></p></div></div></div></div></div></div></div></div></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Thu, Sep 22, 2016 at 10:58 PM, Kristoffer Sheather @ CloudCentral <<a href="mailto:kristoffer.sheather@cloudcentral.com.au" target="_blank">kristoffer.sheather@cloudcentral.com.au</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Rule #1 - never negotiate with terrorists.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div class=MsoNormal align=center style='text-align:center'><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><hr size=2 width="100%" align=center></span></div><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>: "James Hodgkinson" <<a href="mailto:yaleman@ricetek.net" target="_blank">yaleman@ricetek.net</a>><br><b>Sent</b>: Thursday, September 22, 2016 10:56 PM<br><b>To</b>: "Michael Bullut" <<a href="mailto:main@kipsang.com" target="_blank">main@kipsang.com</a>>, "Australian Network Operators Mailing List" <<a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a>><br><b>Subject</b>: Re: [AusNOG] Ransomware...</span><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Nuke the machine, restore from backup.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Pub?<br><br>James<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>On Thu, 22 Sep 2016, at 22:45, Michael Bullut wrote:<o:p></o:p></span></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Greetings Team,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Anyone that has succeeded in eradication without sending a ransom? <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><div><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Warm regards, <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Michael Bullut.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>---<o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Cell:</span></b><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <i>+254 723 393 114.</i><br><b>Skype Name:</b> <i>Michael Bullut.</i><o:p></o:p></span></p></div><div><div><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Twitter:<i> </i></span></b><i><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><a href="http://twitter.com/Kipsang/" target="_blank">@Kipsang</a></span></i><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Blog: </span></b><i><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><a href="http://www.kipsang.com/" target="_blank">http://www.kipsang.com/</a></span></i><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><div><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>E-mail:</span></b><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <i><a href="mailto:main@kipsang.com" target="_blank">main@kipsang.com</a></i><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><i><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>---</span></i><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div></div></div></div></div></div></div></div><div><p class=MsoNormal><u><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>_______________________________________________</span></u><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>AusNOG mailing list<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></span></p></div></blockquote><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p><p><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering.<br><a href="http://www.mailguard.com.au/mg" target="_blank">http://www.mailguard.com.au/mg</a><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'><br><a href="https://console.mailguard.com.au/ras/1PiQVdD2wb/EO2vpAoqT19a9Dnr06wpm/0.212" target="_blank">Report this message as spam</a> <br> <br> <o:p></o:p></span></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></div></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>