In what is believed to be the largest attack of its kind ever recorded, a cyberextortion attack struck in dozens of countries Friday, locking up computers and holding users’ files for ransom at dozens of hospitals, companies and government agencies.

Massive Cyberattack Hits Organizations Around Globe — An aggressive wave of cyberattacks has hit companies and public institutions around the globe, causing international havoc and bringing many services to a standstill. The cyberextortion attempt appeared to use stolen software developed by a U.S. spy agency.

What You Need to Know About Ransomware — What is ransomware? How does it infect your computer? How is the U.S. government’s National Security Agency involved? How to keep your computer safe.

Global Cyberattack Fuels Concern About US Vulnerability Disclosures — A global cyberattack on Friday renewed concerns about whether the U.S. National Security Agency and other countries’ intelligence services too often horde software vulnerabilities for offensive purposes, rather than quickly alerting technology companies to such flaws.

Companies Affected by Global Cyber Attack — A global cyber attack on Friday affected British hospitals, government agencies and companies, such as FedEx Corp., Telefonica SA, Portugal Telecom and Telefonica Argentina, in 99 countries, with Russia, Ukraine and Taiwan the top targets.

Don’t Click: What Is the ‘Ransomware’ WannaCry Worm? — What is so special about WannaCry?
…

Malicious software called “ransomware” has forced British hospitals to turn away patients and affected Spanish companies such as Telefonica as part of a global outbreak that has affected tens of thousands of computers.

How does it work?

WannaCry — also known as WanaCrypt0r 2.0, WannaCry and WCry — is a form of “ransomware” that locks up the files on your computer and encrypts them in a way that you cannot access them anymore.

How does it spread?

Ransomware is a program that gets into your computer, either by clicking on the wrong thing or downloading the wrong thing, and then it holds something you need to ransom.

In the case of WannaCry, the program encrypts your files and demands payment in bitcoin in order to regain access.

Security experts warn there is no guarantee that access will be granted after payment. Some ransomware that encrypts files ups the stakes after a few days, demanding more money and threatening to delete files altogether.

There are different variants of what happens: Other forms of ransomware execute programs that can lock your computer entirely, only showing a message to make payment in order to log in again. There are some that create pop-ups that are difficult or impossible to close, rendering the machine difficult or impossible to use.

Where has it spread?

British-based cyber researcher Chris Doman of AlienVault said the ransomware “looks to be targeting a wide range of countries,” with initial evidence of infections in at least two dozen nations, according to experts from three security firms.

The broad-based ransomware attack has appeared in at least eight Asian nations, a dozen countries in Europe, Turkey and the United Arab Emirates and Argentina, and appears to be sweeping around the globe, researchers said.

What is so special about WannaCry?

WannaCry is not just a ransomware program, it is also a worm.

This means that it gets into your computer and looks for other computers to try and spread itself as far and wide as possible.

Ransomware has a habit of mutating, so it changes over time in order to find different ways to access computers or to get around patches (operating system updates that often include security updates). Many security firms are already aware of WannaCry in past forms and most are looking at this one right now to see how it might be stopped.

Several cybersecurity firms said WannaCry exploits a vulnerability in Microsoft and that Microsoft patched this in March. People don’t always install updates and patches on their computers, and so this means vulnerabilities can remain open a lot longer and make things easier for hackers to get in.

It exploited a vulnerability in the Windows operating system believed to have been developed by the National Security Agency, which became public last month. It was among a large number of hacking tools and other files that a group known as the Shadow Brokers released on the internet. Shadow Brokers said that they obtained it from a secret NSA server.

The identity of Shadow Brokers is unknown, though many security experts believe the group that surfaced in 2016 is linked to the Russian government.

The NSA and Microsoft did not immediately respond to requests for comment.
…

Most technology experts agree that self-driving cars will soon finish the testing phase and enter the commercial market, probably as taxis and delivery vehicles. But some of them wonder if the cars’ artificial brains will be able to cope with the human propensity to bend the traffic rules. VOA’s George Putic reports.
…

An aggressive wave of cyberattacks hit companies and public institutions around the globe Friday, causing international havoc and bringing many services to a standstill. Computers were locked up and users’ files held for ransom when dozens of countries were hit in a cyberextortion attack that targeted hospitals, companies and government agencies.

What is ransomware?

Ransomware is a type of malware that attempts to extort a computer user for money. In some cases, the ransomware encrypts certain files and holds them hostage. In other cases, as happened Friday, it locks a user out of their entire computer system until a ransom is paid. Some ransomware that encrypts files increases the stakes after a few days, demanding more money and threatening to delete files altogether.

Steps of ransomware infection

A ransomware infection usually takes these five steps.

1. The user downloads malware from an infected website or email.

2. The initial malware hijacks the user’s browser and redirects it to a malicious site.

3. Part of the malware, called an exploit kit, looks for vulnerabilities in the user’s system.

4. Once a vulnerability is found, a malicious payload is downloaded onto the victim’s computer.

5. Then the malware calls home with sensitive data from the user’s computer. In the case of ransomware, the malware attempts to extort the user for money.

The ransomware program that spread Friday is not just malware, it is also a worm. This means that the malware gets into a computer and looks for other computers to try and spread itself as far as possible.

Do ransomware attacks generate money for the hackers?

Yes, they can. A hospital system in Los Angeles paid about $17,000 earlier this year following an attack that blocked hospital employees from using email and other forms of electronic communication by using encryption to lock them out of the system. The hackers even set up a help line to answer questions about paying the ransom.

Security industry experts say such attacks are becoming more prevalent, but are rarely made public.

How is the NSA involved?

The hackers appear to have used a technique that was discovered by the National Security Agency and was leaked online in April by a group calling itself the Shadow Brokers.

The malware is exploiting a flaw in Microsoft software. Microsoft created a patch to fix the flaw earlier this year, but not all businesses have updated their operating systems.

Who carried out the attack?

Investigators are pursuing information, but have not said if they have any strong leads. Officials say they believe the attack is the work of criminals and not a foreign government. The original hacking tool was apparently stolen from the NSA and leaked online by the Shadow Brokers, but officials do not know who that group is or whether they carried out this attack.

How to keep your computer safe

Microsoft released a patch in March that fixes the specific vulnerability exploited in this attack. The U.S. Department of Homeland Security is urging people to take three steps.

1. Update your systems to include the latest patches.

2. Do not click on or download unfamiliar links or files in emails.

3. Back up your data to prevent possible loss.
…

An aggressive wave of cyberattacks has hit companies and public institutions around the globe, causing international havoc and bringing many services to a standstill. The cyberextortion attempt appeared to use stolen software developed by a U.S. spy agency.

One of the first and worst attacks was aimed at Britain’s National Health Service. A wave of crippling ransomware hit dozens of hospitals across the country Friday, prompting the NHS to declare a “major incident.” Some hospitals diverted ambulances and canceled surgeries as a result of the attack, which blocked doctors’ access to patients’ files.

Ransomware is a type of computer malware, software that has a malevolent intent, that infects a target system, locks and encrypts all files, and then demands a cash payment from the victim in return for reversing the encryption.

A researcher at the Finnish cybersecurity company F-Secure said Friday’s apparently coordinated attacks were “the biggest ransomware outbreak in history,” The Associated Press reported. An analyst at another cybersecurity firm, Veracode, said the rapid spread of attacks pointed to the involvement of criminal organizations.

45,000 attacks in 74 countries

The international cybersecurity firm Kaspersky Labs, based in Russia, said it recorded 45,000 attacks in 74 countries. The worst hit by far was Russia, with serious problems also reported by computer networks in Taiwan, India and Ukraine.

The Russian Interior Ministry, which oversees police throughout the world’s largest country, at first denied it had been hacked, but later admitted about a thousand of its computers had been penetrated.

There was no immediate word on who carried out the cyberattacks, and it was not known whether any of the victims paid any ransom Friday.

The demands reportedly were for relatively trivial sums — the equivalent of $300, paid in bitcoin, a digital currency. But in past attacks, the payment demands multiplied to much larger sums in short order. Bitcoin payments can be difficult if not impossible to trace.

The ransomware used Friday was labeled with various names — WannaCryptOr, WannaCry or WCry — but all appeared to operate in a similar way. They gained entry to targeted computer systems by exploiting a vulnerability in Microsoft computer operating systems that was discovered and developed by the U.S. National Security Agency.

The security hole, known as “EternalBlue,” was stolen from U.S. government computers and disclosed on the internet earlier this year by a group known as TheShadowBrokers.

Microsoft fixed problem in March

Microsoft issued software patches to close the vulnerability in its operating systems two months ago, but many computer systems around the world have not yet been updated, or instead rely on older equipment that remains vulnerable to attack.

Security experts said the ransomware encountered Friday is a self-replicating piece of software that spreads from computer to computer as it finds systems that have not been shielded from intrusion. The malware enters large organizations’ computer networks, such as those at British hospitals, when an employee clicks on an innocent-appearing attachment to open the file, and thus releases the ransomware.

British Prime Minister Theresa May said it was clear that her nation’s problems were part of a wider international attack that had many victims.

China also was targeted by the unknown computer hackers, and the U.S. parcel delivery firm FedEx said its operations were hit. In Spain, telecommunications giant Telefónica was one of the early victims, and employees of MegaFon, one of the largest cellphone companies in Russia, said they also were hit.

NSA technique used

Computer experts said the ransomware did not to appear to be very sophisticated, but the way in which it spread, using the intrusion technique developed by NSA, clearly was. They noted the ransom demands that flashed onto users’ screens were in dozens of languages, indicating the attack had been well planned and coordinated.

Ransomware attacks and other computer intrusions, such as the hacking incident that unfolded in France last week on the eve of that country’s presidential election, are on the rise throughout the world.

Last year, a hospital in Los Angeles, California, said it paid a $17,000 ransom to regain control of its computers from hackers.
…

A global cyberattack on Friday renewed concerns about whether the U.S. National Security Agency and other countries’ intelligence services too often horde software vulnerabilities for offensive purposes, rather than quickly alerting technology companies to such flaws.

Hacking tools believed to belong to the NSA that were leaked online last month appear to be the root cause of a major cyberattack unfurling throughout Europe and beyond, security researchers said, stoking fears that the spy agency’s powerful cyber weapons had been stolen and repurposed by hackers with nefarious goals.

Some cybersecurity experts and privacy advocates said the massive attack reflected a flawed approach by the United States to dedicate more cyber resources to offense rather than defense, a practice they argued makes the internet less secure.

Across the U.S. federal government, about 90 percent of all spending on cyber programs is dedicated to offensive efforts, including penetrating the computer systems of adversaries, listening to communications and developing the means to disable or degrade infrastructure, senior intelligence officials told Reuters in March.

“These attacks underscore the fact that vulnerabilities will be exploited not just by our security agencies, but by hackers and criminals around the world,” Patrick Toomey, a staff attorney with the American Civil Liberties Union, said in a statement.

The NSA did not respond to a request for comment. Hospitals and doctors’ surgeries in parts of England on Friday were forced to turn away patients and cancel appointments after they were infected with the “ransomware,” which scrambled data on computers and demanded payments of $300 to $600 to restore access.

Security software maker Avast said it had observed more than 57,000 infections in 99 countries. Russia, Ukraine and Taiwan were the top targets, it said.

Private security firms identified the virus as a new variant of ‘WannaCry’ ransomware with the ability to automatically spread across large networks by exploiting a bug in Microsoft Corp’s Windows operating system.

Security experts said the ransomware used in the attacks leveraged a hacking tool found in a leak of documents in April by a group known as Shadow Brokers.

At the time, Microsoft acknowledged the vulnerabilities and said they had been patched in a series of earlier updates pushed to customers, the most recent of which had been rolled out only a month earlier in March. But the episode prompted concerns about whether the tools could be leveraged by hackers to attack unpatched systems.

In a statement, a Microsoft spokesman said on Friday its engineers had provided additional detection and protection services against the WannaCry malware and that it was working with customers to provide additional assistance. The spokesman reiterated that customers who have Windows Updates enabled and use the company’s free antivirus software are protected.

Shadow Brokers first emerged last year and began dumping tranches of documents that it said belonged to the NSA, though the files appeared at least a few years old.

Over time, western researchers have grown more confident that Russia may be behind Shadow Brokers and possibly other recent disclosures of sensitive information about cyber capabilities that have been pilfered from U.S. intelligence agencies.

Some researchers cast blame not on the NSA but on the hospitals and other customers that appeared to leave themselves open to attack.

“The main problem here is organizations taking more than eight weeks to patch once Microsoft released the update,” said Chris Wysopal, chief technology officer at the cyber firm Veracode. “Eight weeks is plenty of time for a criminal organization to develop a sophisticated attack on software and launch it on a wide scale.”

Former intelligence contractor Edward Snowden, who in 2013 leaked documents to journalists revealing the existence of broad U.S. surveillance programs, said on Twitter the NSA had built attack tools targeting U.S. software that “now threatens the lives of hospital patients.”

“Despite warnings, (NSA) built dangerous attack tools that could target Western software,” Snowden said. “Today we see the cost.”
…