Ransomware Cyber Attack: Hackers Leverage Stolen NSA Tool to Wreak Havoc Worldwide

 

HIGHLIGHTS

  • Ransomware WannaCry leveraged hacking tools developed by NSA
  • It exploits a known bug in Windows
  • Researchers have observed 57,000 infections in 99 countries

A global cyber attack leveraging hacking tools widely believed by researchers to have been developed by the US National Security Agency hit international shipper FedEx, disrupted Britain’s health system and infected computers in nearly 100 countries on Friday. Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files.

Private security firms identified the ransomware as a new variant of WannaCry (also known as WanaCrypt0r and WCry) that had the ability to automatically spread across large networks by exploiting a known bug (MS17-010) in Microsoft’s Windows operating system. The ransomware encrypted data on the computers, demanding payments of $300 to $600 to restore access. Security researchers said they observed some victims paying via the digital currency Bitcoin, though they did not know what percent had given in to the extortionists.

Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries with Russia, Ukraine and Taiwan the top targets.

The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers.

International shipper FedEx Corp said some of its Windows computers were also infected. “We are implementing remediation steps as quickly as possible,” it said in a statement.Ransomware Cyber Attack: Hackers Leverage Stolen NSA Tool to Wreak Havoc Worldwide

Still, only a small number of US-headquartered organizations were hit because the hackers appear to have begun the campaign by targeting organizations in Europe, said Vikram Thakur, research manager with security software maker Symantec.

By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur said.

The US Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support.

Telecommunications company Telefonica was among many targets in Spain, though it said the attack was limited to some computers on an internal network and had not affected clients or services. Portugal Telecom and Telefonica Argentina both said they were also targeted.

“Once it gets in and starts moving across the infrastructure, there is no way to stop it,” said Adam Meyers, a researcher with cyber security firm CrowdStrike.

The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a “worm,” or self spreading malware, by exploiting a piece of NSA code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researchers with several private cyber security firms said.

“This is one of the largest global ransomware attacks the cyber community has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.

The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the US spy agency.

Microsoft on Friday said it was pushing out automatic Windows updates to defend clients from WannaCry. It issued a patch on March 14 to protect them from Eternal Blue.

“Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt,” Microsoft said in a statement. It said the company was working with its customers to provide additional assistance.

Sensitive timing
The spread of the ransomware capped a week of cyber turmoil in Europe that kicked off a week earlier when hackers posted a huge trove of campaign documents tied to French candidate Emmanuel Macron just 1-1/2 days before a run-off vote in which he was elected as the new president of France.

On Wednesday, hackers disputed the websites of several French media companies and aerospace giant Airbus .Also, the hack happened four weeks before a British parliamentary election in which national security and the management of the state-run National Health Service (NHS) are important campaign themes.

Authorities in Britain have been braced for possible cyberattacks in the run-up to the vote, as happened during last year’s US election and on the eve of this month’s presidential vote in France.

But those attacks – blamed on Russia, which has repeatedly denied them – followed an entirely different modus operandi involving penetrating the accounts of individuals and political organizations and then releasing hacked material online.

On Friday, Russia’s interior and emergencies ministries, as well as the country’s biggest bank, Sberbank , said they were targeted. The interior ministry said on its website that around 1,000 computers had been infected but it had localized the virus.

The emergencies ministry told Russian news agencies it had repelled the cyberattacks while Sberbank said its cyber security systems had prevented viruses from entering its systems.

New breed of ransomware
Although cyber extortion cases have been rising for several years, they have to date affected small-to-mid sized organizations, disrupting services provided by hospitals, police departments, public transportation systems and utilities in the United States and Europe.

“Seeing a large telco like Telefonica get hit is going to get everybody worried. Now ransomware is affecting larger companies with more sophisticated security operations,” Chris Wysopal, chief technology officer with cyber security firm Veracode, said.

The news is also likely to embolden cyber extortionists when selecting targets, Chris Camacho, chief strategy officer with cyber intelligence firm Flashpoint, said.

“Now that the cyber criminals know they can hit the big guys, they will start to target big corporations. And some of them may not be well prepared for such attacks,” Camacho said.

In Spain, some big firms took pre-emptive steps to thwart ransomware attacks following a warning from Spain’s National Cryptology Centre of “a massive ransomware attack.”

Iberdrola and Gas Natural , along with Vodafone’s unit in Spain , asked staff to turn off computers or cut off internet access in case they had been compromised, representatives from the firms said.

In Spain, the attacks did not disrupt the provision of services or networks operations of the victims, the government said in a statement.

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and subscribe to our YouTube channel.

Cyberbullying Insurance? That’s a Real Thing One Company Is Offering in the UK

It’s no secret that online trolling can be disruptive. Some of its most extreme forms like swatting – where a harasser fakes an emergency to get police to raid a victim’s home – are real world safety threats.

Now an insurer is offering some customers in the United Kingdom benefits to help offset the costs of trolling. Chubb insurance will include cyberbullying coverage as part of its personal insurance package – providing up to 50,000 pounds, or roughly $75,000 (roughly Rs. 50,00,000), that could be used for things like help from online experts for victims and counseling, or even covering lost income if the victim is off work for more than a week due to the harassment – according to the Telegraph.

The company defines cyberbullying as “three or more acts by the same person or group to harass, threaten or intimidate a customer,” the Financial Times reported. The company did not immediately respond to a Washington Post inquiry about the coverage.

The Internet can sometimes be a pretty nasty place – 73 percent of American adults online have seen someone be harassed online and 40 percent have personally experienced it, according Pew Research center study released last year.

In extreme cases, trolling can almost take over a victim’s life. “I feel helpless,” Amy Stater, the victim of a sustained campaign of online harassment apparently linked to her son’s online activities, told Fusionearlier this year. “I can’t get a job, my marriage is over. Not a day goes by that I don’t wonder if it would be easier if I take my own life,” she said.

This new insurance benefit seems to be a shift toward acknowledging just how damaging that type of situation can be.

“We see insurance as helping our clients get back to how they were before the incident occurred – whether it’s an incident that affects their home or as a person,” Tara Parchment, UK and Ireland private clients manager, told the Telegraph. “So we still help to restore homes, cars and belongings that have suffered physical harm or damage, but increasingly it’s about the person and how they cope.”

Cyber-Attack Suspects’ Average Age Down to 17: UK Agency

Britain’s National Crime Agency warns the average age of suspected cybercriminals has become younger, with investigations in the past year showing that suspects’ average age dropped to just 17 compared to 24 in the previous year.

The law-enforcement body says in a recent case, a 12-year-old was among 22 young people arrested on suspicion of buying malicious software that allows users to take control of another computer.

The agency said many teenagers move quickly from “pranking” to higher-level cybercrime, sometimes without considering that they are breaking the law.

The body on Tuesday launched a campaign to educate parents of 12- to 15-year-old boys about cybercrime.

In October a 15- and 16-year-old made headlines when they were arrested over a cyber-attack on telecoms firm TalkTalk.

The October 21 attack, which experts said appeared to use well-established hacking techniques, resulted in the theft of data from some of the phone and broadband provider’s 4 million customers.

TalkTalk earlier this month put the cost of last month’s cyber-attack at GBP 30 million to GBP 35 million ($45.43 million-$53.00 million or roughly Rs. 303 crores – Rs. 353 crores), and said it was too soon to gauge the impact on customer numbers, although it did see an immediate spike in defections. Chief Executive Dido Harding said it had been a “challenging time” for the broadband company’s 4 million customers.