Forgot your password?
typodupeerror
Security The Internet IT

Death Knell For DDoS Extortion? 101

Posted by kdawson
from the greener-pastures dept.
Ron writes "Symantec security researcher Yazan Gable has put forward an explanation as to why the number of denial of service attacks has been declining (coincident with the rise of spam). His theory is that DoS attacks are no longer profitable to attackers. While spam and phishing attacks directly generate profit, he argues that extortion techniques often used with DoS attacks are far more risky and often make an attacker no profit at all. Gable writes: 'So what happens if the target of the attack refuses to pay? The DoS extortionist is obligated to carry out a prolonged DoS attack against them to follow through on their threats. For a DoS extortionist, this is the worst scenario because they have to risk their bot network for nothing at all. Since the target has refused to pay, it is likely that they will never pay. As a consequence, the attacker has to spend time and resources on a lost cause.'"
This discussion has been archived. No new comments can be posted.

Death Knell For DDoS Extortion?

Comments Filter:
  • this just relegates the Spammer to having to attack smaller sites, who cannot afford to bear the brunt of the assult as long as a large site can

    DDoS will be around for a while still
    • I think you are confusing spam and DoS.
    • Not the point (Score:4, Insightful)

      by tygerstripes (832644) on Wednesday May 02, 2007 @07:09AM (#18954777)
      While that's certainly true, I think you're missing the point of the article - that DDoS attacks simply aren't worth the effort and risk when compared to the perfectly viable alternative of spamming.

      If you can choose two ventures, one of which will almost certainly generate revenue with very little risk to you, and the other of which often generates no revenue at all but poses a high risk to your liberty and your resources, which do you choose?

      • by Zeinfeld (263942)
        It is too soon to say whether this is going to be a sustained trend. If it is economics is certainly the reason.

        I would state the reason somewhat differently though. A traditional extortion racket is called protection for a reason - to get paid the extortionist has to provide a guarantee of safety from attack against other gangs, not just his own.

        The DDoS extortion rings can't stop any attacks other than their own. So they cannot provide a guarantee of service. Paying up does not guarantee service.

        Ano

        • All things considered the logical response to targetting by a DDoS attack is to call the police first, then call a DDoS protection specialist. The only time it makes sense to pay up is if you can do a sting and get the perps arrested.

          Hmm, I'd go for a slightly more proactive approach. Just get your pipes from an ISP that provides DoS protection. That way when they send the DDoS attack your ISP will call and say, "hey we're rate limiting some really suspicious traffic. Do you want to log on and take a look and decide what should be dropped?" Then you can call the police.

  • What will come of the 0x09F911029D74E35BD84156C5635688C0 zombie machines out there? Converted to spam remailers? /yea, I know, -1 redundant, but it is still funny.
    • by Penguinisto (415985) on Tuesday May 01, 2007 @06:39PM (#18949269) Journal
      Could be that someday, somebody is going to cobble together a P2P-style redundant agent that coulod convert a botnet into a big-assed torrent server.

      I mean, what better place (from an objective POV) to park warez and illicit data (e.g. certain types of illegal pr0n), than on some unsuspecting schlep's machinery?

      The mobsters then charge admittance by way of proxies (conceptual term, not 'w.x.y.z:8080') and advertise by way of spam?

      /P

      • Re: (Score:2, Insightful)

        by blhack (921171)
        They already do that. See: the entire movie bootlegging scene.
      • Re: (Score:2, Informative)

        by HeroreV (869368)
        To learn more, see XDCC at Wikipedia [wikipedia.org].
      • by tinkertim (918832) *

        Could be that someday, somebody is going to cobble together a P2P-style redundant agent that coulod convert a botnet into a big-assed torrent server.

        Only if egress filtering were outlawed by congress, or a serious serious hole was found in the 2.6 Linux kernel. One of the other things that makes botnets yummy for spam is the fact that port 25 is often NOT filtered on egress, so if your able to escape / inject and get a shell, you're home free.

        Bot's aren't so hot at accepting incoming connections because the

    • by dexomn (147950)
      Fuck man, and I thought the SPAM was the DDoS... dur
  • by The_Wilschon (782534) on Tuesday May 01, 2007 @06:23PM (#18949103) Homepage
    By this logic, nobody would ever engage in any kind of extortion. Clearly, people do, so either people are just acting illogically, or there is some flaw. I'm guessing some of both.
    • by idesofmarch (730937) on Tuesday May 01, 2007 @06:32PM (#18949187)
      That is not entirely true. In the present scenario the potential extortionist has a choice - spam or extort. Spamming is currently more profitable, or so the argument goes, and therefore, there are fewer extortions. In the world outside of botnets, extortionists may not have such easily available alternatives, so they stick to extortion.
      • by ceoyoyo (59147)
        Why don't the online extortionists DDOS the non-payers with spam? ;)
      • Re: (Score:3, Interesting)

        In the present scenario the potential extortionist has a choice - spam or extort. Spamming is currently more profitable, or so the argument goes, and therefore, there are fewer extortions.

        That's a nice theory, but I don't think that is what happens in practice. From what I've seen no one runs a botnet that is constantly sending spam or performing attacks. They spend most of their time idle. If you know the right places to look there are some nice Web interfaces where you can transfer money from paypal to rent out control of a botnet for a set amount of time. The operator doesn't care if you're spamming or DDoSing people, only that he got paid. Thus, while people may find spamming more prof

    • by R3d M3rcury (871886) on Tuesday May 01, 2007 @07:04PM (#18949477) Journal
      It's sort of like kidnapping.

      Way back when, kidnapping was a pretty good way to make some quick cash. Grab somebody's significant other and tell them to deliver money to see them again. The automobile was pretty new and you could grab somebody and get them far enough away in a short amount of time that local law enforcement couldn't deal with it.

      Thus, the feds were immediately brought in to any kidnapping case. Because the FBI had kidnapping specialists who knew all the angles, kidnapping for ransom became very unsuccessful. Nowadays, you rarely hear of a kidnapping case with a ransom demand here in the United States. It's just not worh it.
      • by f1055man (951955)
        "Nowadays, you rarely hear of a kidnapping case with a ransom demand here in the United States. It's just not worh it."
        This guy threw in a new wrinkle: http://www.firstcoastnews.com/news/florida/news-ar ticle.aspx?storyid=81035 [firstcoastnews.com]

        He obviously has some self-esteem issues.
        • I doubt this is the first time that's happened, and if so, it's just life imitating art. I've seen that type of thing done on TV several times in the last few years.
      • Re: (Score:2, Funny)

        by Anonymous Coward
        Actually, it sounds more like someone kidnapping someone's wife, only to have the ransom demands met with "keep her!"
      • by soft_guy (534437) *
        But apparently they can't solve the problem of kidnapping for ransom in south america because it is still a major problem there.
        • Re: (Score:3, Informative)

          by joe_kull (238178)
          South America, the Philippines (well, less Luzon than the other islands), southern Asia... lots of places. Probably because a lot of those places have weak central governments so "The Feds" aren't around to bring massive resources to bear on every single kidnap case. If they were, I'm sure the US solution would work fine.

          If.
          • Re: (Score:3, Funny)

            by Reaperducer (871695)

            the US solution would work fine.
            Never thought I'd see that phrase on Slashdot.
          • by westyx (95706)
            It's not so much "The Feds" as strong and uncorrupted law and order structures.
    • Revenge (Score:3, Funny)

      by Hao Wu (652581)
      It isn't enough for DOS to stop. I want them to pay for what they have done to my beautiful internet. I want them to bleed and to suffer greatly for crime of extorting moneys from innocent web administrators.
    • ..at least not directly. A DoS attack, whilst it may not win money, is a very useful thing indeed if you are taking down competition, or trying to affect the share price of a company, or taking on a political enemy.

      We may be seeing the fall of random attacks, but attackers will still be busy doing jobs for money.

    • Re: (Score:3, Interesting)

      by fermion (181285)
      No, by this logic it means that few would conduct such attacks for money. However we know that people conduct attacks for many other reasons. The assumption that attacks occur only for direct cash rewards results in miscalculations that cause significant holes in security systems and can even start wars.

      On the relative benign side we know that people crack security just to see if it can be done, to test their wits against a verified expert. On the less benign side, fanatics might attack because they t

      • fanatics might attack because they think the act will give them some other reward. For instance, if we take a purely hypothetical example, religious fanatics might be told by their Pastor to attack the web site of some godless politician

        Right on. Richard Dawkins (noted Atheist) has a forum which was DoS not long ago (the DoS'er bragged about it too, on their own forum). Sad, really. The forum stayed up, but was slow, so it wasn't that bad. T

  • What??? (Score:1, Troll)

    by cyphercell (843398)

    His theory is that DoS attacks are no longer profitable to attackers...

    Tell that to this guy... http://www.microsoft.com/presspass/exec/billg/defa ult.mspx [microsoft.com]

  • by Penguinisto (415985) on Tuesday May 01, 2007 @06:32PM (#18949183) Journal
    The author, if I read this correctly, assumes that the risk is constant... but compare the profit from spammers (who can make payments more directly, as noted), and extortionists (who stand a good --not perfect, but good-- chance of having that payment traced/tracked. Sure, it'll go to some money-handling service in Russia or whatnot, but that wouldn't put it completely out of the realm of trackability.

    They still want the money somehow, and getting it bears higher risk with extortion than by simply grabbing dough under-the-table from spammers.

    I suspect (okay, hope?) that spamming will begin to lose its profit motive as well, as users become computer-literate enough en masse to ignore emailed pitches... making the reward not really worth the effort. Even the dumbest user can get ripped off only so many times before they either a) go broke, or b) figure out that maybe they should stop buying stuff from spammers.

    /P

    • by tmarthal (998456) on Tuesday May 01, 2007 @06:43PM (#18949301) Homepage
      He also doesn't seem to get that sometimes people DoS sites out of spite [slashdot.org] or out of malice [vitalsecurity.org].

      You can't put a pricetag on being an asshole to the internet community.
      • by Chmcginn (201645)
        Well, to be fair, he does mention "extortion" enough times that one would not be too far off assuming that he's talking about crime for monetary gain, as opposed to a crime of passion... umm... well, I suppose DDOSing a blogger than made fun of you could be considered passion.

        Really lame passion, but so it goes.

      • There will always be kiddie. But Symantec should be focused on the CTO and the SMB/Enterprise customer. The kinds of places they've targeted these [symantec.com] kinds products at.

        Suggesting that DDOS attacks will go away would be silly, but as a business concern which security companies have whipped up to a somewhat feverish pitch this is a sign that these concerns are changing. Anyway, DDOS solutions where probably nowhere near as lucrative as other more trendy areas of network protection (spam/worms/malicious web-con
    • by k12linux (627320)
      Unfortunately there is no shortage of people who will do dumb things which are not in their best interest.

      It's a numbers game. If you are getting millions of spams into inboxes worldwide daily you don't need that many people to buy your product/service to make significant profits. 1% of 1 million is still 10,000. (And in the US, 1.5% if us have an IQ BELOW 60.)

  • These people will surely find some other way to fill their day.
  • It's just calling their bluff. Can they handle a DOS? If so, bring it on. Otherwise, they may end up financially better off to just pay them. Assuming you can trust that they'll not do it anyway.
    • by Dan Ost (415913)
      Would you trust a criminal to keep his word?

      Even if you do, would you trust other criminals not to extort you once it's known that you have a history of caving to such threats?
  • by psaunders (1069392) on Tuesday May 01, 2007 @06:38PM (#18949257)

    For a DoS extortionist, this is the worst scenario because they have to risk their bot network for nothing at all.
    You don't need a bot network to be a DoS extortionist. Unplugging your target's modem is just as effective, and has the virtue of simplicity.

    The extortion part is difficult though, since the target must decide whether to comply with your demands (i.e. payment) or else just give you a good thrashing.

    • by myowntrueself (607117) on Tuesday May 01, 2007 @07:36PM (#18949735)
      You don't need a bot network to be a DoS extortionist. Unplugging your target's modem is just as effective, and has the virtue of simplicity.

      I think I see where you are coming from; my ISP is some kind of DoS extortionist... if I stop paying them they DoS me.

      Help, I am being exploited! :(
      • "All established utility provision is legalised blackmail" - Marx.


        (Groucho or Harpo, I forget which).

  • by OrangeTide (124937) on Tuesday May 01, 2007 @06:43PM (#18949299) Homepage Journal
    Got some nuclear research you'd like to do but don't have the resources to create a super computer? rent a botnet!

    Perhaps we could make them into a self-aware AI one day, imagine that. an AI running on poorly secured Windows boxes
    • by v4r4n (827224)
      Ever sit all the way through Terminator 3? 'Skynet' was simply out there on the internet... http://en.wikipedia.org/wiki/Skynet_(fictional)#In _Terminator_3:_Rise_of_the_Machines [wikipedia.org]
    • Re: (Score:3, Insightful)

      by element-o.p. (939033)
      ...and Skynet was born <shudder>
    • Perhaps we could make them into a self-aware AI one day, imagine that. an AI running on poorly secured Windows boxes

      Especially if those poorly secured Windows boxes were running Windows for Warheads/Warships...
    • Re: (Score:3, Interesting)

      by MoxFulder (159829)

      Got some nuclear research you'd like to do but don't have the resources to create a super computer? rent a botnet!

      Funny, but unlikely I think.

      Botnets wouldn't be all that good for supercomputing, except maybe of highly parallelizable problems (voluntary networks like SETI@home already work on those). Botnets don't have the fast communication links between nodes which are vital to the performance of most supercomputers... which often incorporate fancy network technologies like Infiniband or Fiber Channel or

      • by mosch (204)
        A commodity computer can EASILY spit out 50 MB of email per second with some intelligent software... but *paying for* the bandwidth to actually send it that fast would be absolutely prohibitive. That's the real reason spammers use botnets.

        Prices from my inbox:
        50Mbps sustained, burstable to 100mbit, $2,000/month.
        100Mbps sustained, $3,700/month.
        300Mbps sustained, $10,800/month.

        (Of course, there's also the fact that botnets are a lot harder to isolate and blacklist than a single server.)

        Bingo.
    • Virus? (Score:2, Funny)

      by sonictheboom (546359)
      What happens when it gets a virus? AI goes crazy? What happens when it becomes self aware and finds out that it is made out of Windows? Self loathing and madness. Scary thoughts.
    • by garwain (688087)
      > Perhaps we could make them into a self-aware AI one day, > imagine that. an AI running on poorly secured Windows boxes Why bother? As soon as it becomes self-aware enough to realize it's running on windows, it will commit suicide...
  • DDoS attacks were profitable for years. The author is citing challenges that have always been a part of the practice as the reason they turned to an older technique - as if the idea hadn't panned out. As far as the risk involved, everything I've heard about people responding to botnets was pretty much about people watching to see how big a problem it was. The only thing I've ever heard about someone fighting back was this guy [slashdot.org], and unless there were a lot more like him over the following year than I heard

  • by Chabil Ha' (875116) on Tuesday May 01, 2007 @06:45PM (#18949325)
    That all DDoS attacks are for the purpose of extortion. Does nobody do these things simply because they just want to blackball someone [wikipedia.org] anymore? No, this isn't the death of the DDoS.
    • by gbjbaanb (229885)
      After reading this, the best thing the BlueFrog people could have done was to taunt the attackers and refuse to stop. Nothing would be different from today's state (where BlueFrog effectively closed down), but the botnet used to DDoS them would still be used in the attack, and not used to send out millions of spams. And the spammer would be poorer and more pissed off.

      So the moral of this story, kids, is never give in to the blackmailers.
      • Unfortunately, the wikipedia article doesn't explain that Blue Frog decided against any sort of retaliation because 'they didn't feel that they had the right to bring their users into an all-out war with spammers'. Too bad. I think that they had positioned themselves to put a serious dent in the spam wars, and they ran off with their tail between their legs. Too bad, indeed.
  • by southpolesammy (150094) on Tuesday May 01, 2007 @06:52PM (#18949385) Journal
    Even if the victim doesn't pony up to stop the DoS, they still pay in lost service and opportunity. In this regard, a DoS against a big moneymaking site means a huge loss of revenue. How long until an ethically-challenged company DoS's their competition?
    • by zappepcs (820751)
      Well, there are worse things that can be done with a bot net. Having the botnet as receptor nodes, it would be possible to commit anonymous industrial espionage with a combo of botnet and virii/worms as information collectors. If you get hired to spy, and are paid regularly, you can come and go as you please through the victim's network once you have infiltrated it.

      Things that might be transported via botnet: pr0n, spying, video downloads, terrorist messaging, and apparently none of the RNC messages. Anyth
    • How long until an ethically-challenged company DoS's their competition?

      If it hasn't happened already, all what someone needs to do is get their competitor onto the front page during a critical service.

    • How long until an ethically-challenged company DoS's their competition?

      I think it has been done or attempted. The name escapes me right now. The few details I remember was that the owner or a manager asked an employee to do it, the employee did it and then the management denied ever asking.
  • At the least the idea that an extortionist has to carry out the DoS when after being denied payment doesn't make much sense. Since I assume they (the extortionist) are essentially remaining anonymous, there really isn't any need to prove anything, particularly after you know you aren't getting any money from the person you're attacking. As long as there are others still carrying out the attacks, so that they remain a believable threat, there's no reason for you personally to get involved.

    So while I think
    • by westyx (95706)
      There is a need to prove something - if you target an online casino, they don't pay and you ddos them, their competitors will notice and realise it could happen to them. Whereas, if you don't follow through on your threat to ddos them, word will still get around, but it will be "the threats are empty".
  • Symantec security researcher Yazan Gable has put forward an explanation as to why the number of denial of service attacks has been declining (coincident with the rise of spam). His theory is that DoS attacks are no longer profitable to attackers.

    Surely he meant it was because their super efficient Windoze clients had secured the world and saved us all from this and other dastardly threats! No? Oh well.

    • by iago-vL (760581)
      Believe me when I say, Yazan doesn't care whether or not people are running Norton's products.
      • by twitter (104583)

        Believe me when I say, Yazan doesn't care whether or not people are running Norton's products.

        Oh, I can believe that and I'm sure Yazan is good at what he does. That's not what amused me.

  • by seaturnip (1068078) on Tuesday May 01, 2007 @07:29PM (#18949677)
    If someone refuses to pay, just don't DDoS them and move on. It's not like your reputation for following through on threats is on the line, you're a secretive criminal.
    • by MoxFulder (159829) on Tuesday May 01, 2007 @08:21PM (#18950057) Homepage
      This is sort of a game theory problem.

      No individual extortionist wants to actually expend the resources to make good on his threat... but all extortionists recognize that if NO ONE carries out their threats, they will have no power over the victims.
      • Sure, but extortionists are selfish bastards, right? Since they are willing to screw over society to make a buck, why wouldn't they screw over the rest of the extortionists to avoid losing their botnet?
        • by karmatic (776420)
          If they aren't going to use it anyway, why not just skip the whole botnet thing in the first place? Tell people you will DOS them, then don't do it regardless of if they pay.

          You can't lose what you don't have, and the victim has little way of knowing if you are serious anyway.
          • Nobody will pay you if you do that. Any wanker can send an email threatening to DoS you with no proof. You DoS them once, then threaten to DoS them again. RTFA.
  • From my experience (Score:5, Informative)

    by jbossvi (946552) on Tuesday May 01, 2007 @07:57PM (#18949885)
    These guys have hit us up before. From what I have seen it is a
    -give us $ or we shut you down.
          -a small quick ddos to show you they can.
    -you say "no thanks", so now they ask for $$$.
          -a little bit longer ddos because you pissed them off.
    -now they ask for $$$$$. which you certainly are not going to pay.
          -another little ddos, more email threats of looming death and destruction, they are "leet" after all.

    at this point you begin to factor outages and lost revenues into the business plan, you call ISP's, you consider calling the FBI.

    they eventually go away. The best advice we got was from someone who has a "relationship" (pronounced cashcow) with a ddos'r. The scam is that they are looking for regular clients that they know can/will pay, and that they can hit up when they need cash. The word has gotten around that if you pay once, you'll pay twice. At least in the business of online casino's everyone has begun to understand that you just dont pay, ever.
  • "Pay me money or I'll.....post a link on Slashdot!"
    "Oh God...anything but that! I'll Pay!"
  • Assumptions (Score:1, Interesting)

    by sortius_nod (1080919)
    I think it's a bit stupid to assume because the attacks have gone down are a result of not paying up. IMO it would be more of an indication of companies paying up.

    Think about it. If you run a large corporation that downtime means losses that can run into the millions of dollars even for a short duration, add to this the cost of untangling any sort of mess associated with this downtime and that's a heafty bill. It would be stupid to risk the possibility of losing money (and possibly clients) due to downtim
    • by gbjbaanb (229885)
      except that if you pay once, you'll very likely pay again.. and again... and again...

      in the case on online extortion, so what if you bankrupt them - you don't care, there are thousands upon thousands more marks out there.
  • Didnt see in the article any mention of the fact that spammers are using Denial of Service attacks on anti-spam related infrastructure too - can't see those falling by the wayside any time soon. re: Blue Security - http://it.slashdot.org/article.pl?sid=06/05/08/142 229 [slashdot.org]
  • by eraser.cpp (711313) on Tuesday May 01, 2007 @11:59PM (#18952051) Homepage
    I'm of the opinion that the software industry has just wised up a bit to security threats. IT too has become better at reducing their surface area of attack and patching products; Windows automatic updates probably did a world of good. Many ISPs filter the majority (all?) ports open by default on Windows as well. I help run a fairly large IRC network and we have seen the frequency of botnet activity and DDoS attacks drop dramatically over the last couple years. It's good and bad, I personally found things a little more exciting when a major hole would come out and chaos would ensue for the next week. Remember when blaster came out and the Internet grinded to a halt?
  • by linenoise (34380) on Wednesday May 02, 2007 @12:03AM (#18952095)

    Another factor why the DDoS extortion of today is less profitable than a few years back is the existence of mechanisms to mitigate attacks more effectively. Companies like Arbor Networks and Cisco make products that let enterprises and Service Providers quickly flip a switch to redirect and protect legitimate customer traffic. I helped design the Sprint IP Defender [sprint.com] solution, providing Sprint customers both quick notification of a security event AND the option to circumvent the issue. This takes all the control away from the extortionists.

    Naturally, being employed in the managed security space, I have a dichotomy of interests that should not be forgotten - yes I want to see DDoS incidents being eliminated BUT yes I work for a company where fear of an incident leads companies to buy services from us which in turn drives up my 401k. There is big business in fear, but hey, if you lose $100k in revenue every 10 minutes your network is down, it only makes sense that you protect that income stream. Anyways, for every one extortionist, there are three script-kiddies hanging out in #l33tddos on EFnet wanting to see the level of damage he/she can impose.......

    G'night all.
    • Anyways, for every one extortionist, there are three script-kiddies hanging out in #l33tddos on EFnet wanting to see the level of damage he/she can impose......

      Yeah, I've seen a number of session captures from botnet control networks. A lot of botnet operators are simply renting out time on their botnet and they don't care if you're sending spam for profit or trying to DDoS the americans. One session in particular was controlled by a guy attacking Denmark IP blocks during the whole mohammed cartoon debacle. It took the guy multiple tries to figure out the simple commands to launch an attack, he targeted a block of cable modems with no real value and he attacked

    • I've heard that there are some hosting providers out there that are so well connected that any attempt to DDoS them just shuts down one of their upstream links, without any significant effect on global availablity of the web sites they host.
      • I've heard that there are some hosting providers out there that are so well connected that any attempt to DDoS them just shuts down one of their upstream links, without any significant effect on global availablity of the web sites they host.

        I can understand how such a thing might happen in the short term for a regular DoS attack, but why would a DDoS attack not be incoming on all their upstream links more or less equally? Obviously if you have enough bandwidth it will only clog your smaller pipes, but that is a lot more expensive of a proposition in several ways than mitigating the DDoS using standard routing techniques.

  • by Anonymous Coward
    I think the real reason is that extortions do not make real sense in an online enviroment. Why:

    There is no real threat. You will never get killed/injured it is just about numbers. And since: If you pay once you will pay twice (and thrice...) is so true it is better/cheaper to never ever pay and just take the pain once. You will just loose chash no fingers!

    There is no way to protect a turf. If I pay a) then b) could extort me also or even worse a) could pretend to be b) or c) now to extort even more money. I
  • When you don't pay your drug dealer, him coming and killing you doesn't increase the odds of *you* paying (at all); but it reinforces his reputation, so others will be sure not to fail in their payments. I don't see how this is any different. Yes, if you make a threat, and have to follow through, there is no direct benefit from the effort required in following through; however, there is "P.R." value for your next threat.
    • Doesn't work? (Score:3, Insightful)

      by tygerstripes (832644)
      I don't think this would hold true in the corporate world.

      Most businesses who refuse to pay up get someone in quickly to prevent their internet tubes getting clogged. Either that or (if it's cheaper) just let it happen, and find a way around it or ride it out. Either way, they won't actually publicise the proposed extortion as it's bad PR for them. Similarly, if they do pay up, nobody ever finds out about it - so there's no PR again. (Obviously there are exceptions in both cases, but for every exception yo

The greatest productive force is human selfishness. -- Robert Heinlein

Working...