The author discloses the conflict of interest.
Disclosure doesn't necessarily make every conflict of interest acceptable. If somebody posts, "how do I do X" and somebody answers, "just buy product Y, disclaimer: I am author of product Y," then we would not accept that as a valid answer.
Furthermore, other posters in this thread are talking about this disclosure like its some altruistic attempt at transparency. You really think a criminal cares about the SE rules? My guess is that he discloses his affiliation because it's the only way to support his answer. He can't show any code or point to any documented examples, so instead he says, "I know because I created it."
For these two reasons, I assert that the disclosure is totally worthless and should not be considered a mitigating factor in this poor quality answer.
This specific malware author is not benefiting from this specific instance.
He doesn't benefit directly from this one answer, but in the same sense that industry associations lobby for policies beneficial only to their members, this criminal is lobbying for an answer to the question that benefits members of his industry — himself included.
It is clearly in his interest to convince people not to try to defeat ransomware. Especially if he can convince security experts on this site, then those security experts take that knowledge back to their coworkers, friends, and family.
Could you picture him providing an answer that undermines his business? "Suspending ransomware is a really good way to mitigate the damage, and I know because the ransomware I wrote is utterly defeated by this tactic!" Of course he wouldn't say this. He's not going to undermine his own business. Ergo, telling people not to suspend ransomware is a way of supporting his own business.
People have the info they need to make an informed decision.
How does this answer inform the reader? It is absurdly brief, provides no explanation, and offers no citations to support its points. It is the shortest of all 8 answers for that question. The next shortest answer is about twice as long, and the average answer is probably 5-10 times as long, which suggests something about the amount of information in this answer.
From a technical standpoint, it has validity.
I see no evidence of this. Many technical questions have an easily verifiable answer, e.g. run some code and see if it works. Answers that are difficult to verify directly should cite some authoritative source (documentation or source code). An opinion-only answer or a "just trust me" answer is not a good fit for SE.
According to InfoWorld, there are many instances where paying the ransom simply doesn't work at all.
In this case, letting ransomware run to completion is exceedingly unlikely to benefit the victim:
- Files that were not yet encrypted could have been backed up.
- Files that were already encrypted were conceivably recoverable under a number of plausible scenarios (weak encryption, failing to overwrite plaintext, etc.).
- A file that is in the process of being encrypted could conceivably be corrupted, but not if the ransomware writes the complete ciphertext before overwriting the plaintext. And if a file is corrupted in this way, the probability that it is an important file is
# of important files / # of files, which could be a very low probability — much, much lower than the probability that some of the unencrypted files are important.
Given the OP's scenario of not being willing to pay the ransom, points #2 and #3 aren't even on topic.
Should we allow malware authors to weigh in on questions?
6 upvotes for a comment saying you're a "sissy" if you disagree, but when it comes to the bad guy, nobody wants to call him names! "Malware author" is a generous characterization of what he does.
He's a criminal.
His ilk are extorting hospitals, potentially leading to interrupted medical care and resulting in illness and death. Even if his opinion was technically valid (it's not) and answered the question (it doesn't) and didn't serve his own interests (it does), he still shouldn't be given a voice in this community.
I'll shut up now.