The United States has alleged that Russia hacked several hundred computers used by the authorities at the 2018 Winter Olympic Games in South Korea.

They carried out the operation and tried to make it appear as though the intrusion was conducted by North Korea, what is known as a &quot;false-flag&quot; operation, said two US officials who spoke on the condition of anonymity to discuss a sensitive matter.

Officials in Pyeongchang acknowledged that the Games were hit by a cyberattack during the February 9 opening ceremony but had refused to confirm whether Russia was responsible. The internet services were affected as well as the broadcast systems and the Olympics website. Many attendees were unable to print their tickets for the ceremony, resulting in empty seats.

As the days passed by, cybersecurity researchers had thought Russian hackers would retaliate against the International Olympic Committee for doping violations. Any Russian athletes that were allowed to attend were prohibited from competing under the Russian flag or anthem.

The Russian athletes were punished by the IOC before these games in response to Russia&#39;s alleged state-sponsored doping program that marred the 2014 Winter Olympics in Sochi, Russia.

However, 168 Russian athletes are allowed to compete in the Games under a neutral flag.

According to an intelligence report, the Russian military agency GRU had access to as many as 300 Olympic-related computers in February.&nbsp;

As per media reports, US officials are concerned the Russians may try to disrupt the closing ceremony on Sunday. &quot;We&#39;re watching it pretty closely,&quot; said one. &quot;It&#39;s essentially a Korean problem,&quot; the official added. &quot;We will help the Koreans as requested.&quot;

According to an intelligence report, the Russian military agency GRU had access to as many as 300 Olympic-related computers in February

The United States has alleged that Russia hacked several hundred computers used by the authorities at the 2018 Winter Olympic Games in South Korea. They carried out the operation and tried to make it appear as though the intrusion was conducted by North Korea, what is known as a "false-flag" operation, said two US officials who spoke on the condition of anonymity to discuss a sensitive matter. Officials in Pyeongchang acknowledged that the Games were hit by a cyberattack during the February 9 opening ceremony but had refused to confirm whether Russia was responsible. The internet services were affected as well as the broadcast systems and the Olympics website. Many attendees were unable to print their tickets for the ceremony, resulting in empty seats. As the days passed by, cybersecurity researchers had thought Russian hackers would retaliate against the International Olympic Committee for doping violations. Any Russian athletes that were allowed to attend were prohibited from competing under the Russian flag or anthem. The Russian athletes were punished by the IOC before these games in response to Russia's alleged state-sponsored doping program that marred the 2014 Winter Olympics in Sochi, Russia. However, 168 Russian athletes are allowed to compete in the Games under a neutral flag. According to an intelligence report, the Russian military agency GRU had access to as many as 300 Olympic-related computers in February. As per media reports, US officials are concerned the Russians may try to disrupt the closing ceremony on Sunday. "We're watching it pretty closely," said one. "It's essentially a Korean problem," the official added. "We will help the Koreans as requested."

Olympics cyberattack planned by Russian hackers, attempted to blame North Korea: US

The United States on Thursday pinned the blame for the massive 2017 &#39;NotPetya&quot; cyber attack firmly on Russia and warned Moscow it will face &quot;international consequences.&quot;

The attack launched in June 2017 by the Russian military &ldquo;spread worldwide, causing billions of dollars in damage across Europe, Asia and the Americas,&rdquo; White House Press Secretary Sarah Sanders said in a statement.

&ldquo;It was part of the Kremlin&rsquo;s ongoing effort to destabilize Ukraine and demonstrates ever more clearly Russia&rsquo;s involvement in the ongoing conflict,&rdquo; Sanders said. &ldquo;This was also a reckless and indiscriminate cyber attack that will be met with international consequences.&rdquo;

The attack affected thousands of computers, particularly affecting multinational companies and critical infrastructure. The Kremlin has denied involvement.

The statement came days after leaders of US&nbsp;intelligence agencies again warned that Russia, and potentially other adversaries, were likely to attempt to use cyber means to meddle in the U.S. midterm elections in November.

The US&nbsp;government is &ldquo;reviewing a range of options,&rdquo; a senior White House official said when asked what consequences Russia would face.

It was not clear what those options were, nor what was meant by &ldquo;international consequences.&rdquo;

Earlier on Thursday Russia denied being behind the attack, saying the accusations were part of a &ldquo;Russophobic&rdquo; campaign that it said was being waged by some Western countries.

The White House had intended to release a statement about &lsquo;NotPetya&rsquo; at the same time as London, but those plans were delayed due to a<a href="http://www.wionews.com/world/florida-shooting-suspect-was-part-of-white-supremacist-group-33018"> school shooting in Florida</a>, according to three sources familiar with the matter.&nbsp;

(With inputs from agencies)

The attack launched in June 2017 by the Russian military “spread worldwide, causing billions of dollars in damage across Europe, Asia and the Americas

The United States on Thursday pinned the blame for the massive 2017 'NotPetya" cyber attack firmly on Russia and warned Moscow it will face "international consequences." The attack launched in June 2017 by the Russian military “spread worldwide, causing billions of dollars in damage across Europe, Asia and the Americas,” White House Press Secretary Sarah Sanders said in a statement. “It was part of the Kremlin’s ongoing effort to destabilize Ukraine and demonstrates ever more clearly Russia’s involvement in the ongoing conflict,” Sanders said. “This was also a reckless and indiscriminate cyber attack that will be met with international consequences.” The attack affected thousands of computers, particularly affecting multinational companies and critical infrastructure. The Kremlin has denied involvement. The statement came days after leaders of US intelligence agencies again warned that Russia, and potentially other adversaries, were likely to attempt to use cyber means to meddle in the U.S. midterm elections in November. The US government is “reviewing a range of options,” a senior White House official said when asked what consequences Russia would face. It was not clear what those options were, nor what was meant by “international consequences.” Earlier on Thursday Russia denied being behind the attack, saying the accusations were part of a “Russophobic” campaign that it said was being waged by some Western countries. The White House had intended to release a statement about ‘NotPetya’ at the same time as London, but those plans were delayed due to a school shooting in Florida, according to three sources familiar with the matter. (With inputs from agencies)

Russia to face 'consequences' for 'NotPetya' cyber attack, says White House

The US Department of Homeland Security <a href="http://www.wionews.com/world/britain-believes-north-korea-was-behind-ransomware-wannacry-nhs-cyber-attack-23030">issued an alert on Tuesday warning malware developed</a> in North Korea may still be hidden in computer networks worldwide.

US officials told AFP a hacker group called &quot;Hidden Cobra&quot; also known as &quot;Lazarus&quot; has the ability to &quot;maintain a presence on victims&#39; networks&quot; with the aim to &quot;further network exploitation.&quot;

Last month, Britain had blamed North Korea for being behind the WannaCry cyber attack in May which had disrupted the nation&#39;s health services and businesses. The WannaCry virus had infected more than 300,000 computers in 150 countries within a few days.

&nbsp;DHS Computer Emergency Response Team said some networks could be infected with the Volgmer &quot;backdoor Trojan&quot; which gives hackers complete control of a computer system.

The team said FBI suspects Fallchill tool was being used since last year and Volgmer since 2013.&nbsp;

Hackers in the Hidden Cobra or Lazarus group have been active since 2009 and &quot;have leveraged their capabilities to target and compromise a range of victims,&quot; according to a DHS report in June, AFP said.

&quot;Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature,&quot; the report added.

DHS Computer Emergency Response Team said some networks could be infected with the Volgmer "backdoor Trojan" which gives hackers complete control of a computer system.

The US Department of Homeland Security issued an alert on Tuesday warning malware developed in North Korea may still be hidden in computer networks worldwide. US officials told AFP a hacker group called "Hidden Cobra" also known as "Lazarus" has the ability to "maintain a presence on victims' networks" with the aim to "further network exploitation." Last month, Britain had blamed North Korea for being behind the WannaCry cyber attack in May which had disrupted the nation's health services and businesses. The WannaCry virus had infected more than 300,000 computers in 150 countries within a few days. DHS Computer Emergency Response Team said some networks could be infected with the Volgmer "backdoor Trojan" which gives hackers complete control of a computer system. The team said FBI suspects Fallchill tool was being used since last year and Volgmer since 2013. Hackers in the Hidden Cobra or Lazarus group have been active since 2009 and "have leveraged their capabilities to target and compromise a range of victims," according to a DHS report in June, AFP said. "Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature," the report added.

North Korean malware still lurks in computers worldwide: US

A spate of incidents involving US warships in Asia, including a deadly collision this week off Singapore, has forced the navy to consider whether cyberattackers might be to blame.

While some experts believe that being able to engineer such a collision would be unlikely, given the security systems of the US Navy and the logistics of having two ships converge, others say putting the recent incidents down to human error and coincidence is an equally unsatisfactory explanation.

The USS John S. McCain collided with a tanker early Monday as the warship was on its way for a routine stop in the city-state, tearing a huge hole in the hull and leaving 10 sailors missing and five injured.

The Navy announced Tuesday that remains of some of the sailors were found by divers in flooded compartments on the ship.

The Chief of US Naval Operations Admiral John Richardson said on Monday he could not rule out some kind of outside interference or a cyberattack being behind the latest collision, but said he did not want to prejudge the inquiry. His broader remarks suggested a focus on &quot;how we do business on the bridge&quot;.

&quot;We&#39;re looking at every possibility,&quot; Richardson said, when asked about the possibility of a cyberattack, adding &quot;as we did with Fitzgerald as well.&quot;

Just two months earlier in June, the USS Fitzgerald and a Philippine-flagged cargo ship smashed into each other off Japan, leaving seven sailors dead and leading to several officers being disciplined.

There were also two more, lesser-known incidents this year -- in January USS Antietam ran aground near its base in Japan and in May, USS Lake Champlain collided with a South Korean fishing vessel. Neither caused any injury.

Admiral Scott Swift, commander of the US Pacific Fleet, has refused to rule out sabotage in Monday&#39;s incident, saying all possibilities are being examined.

&quot;We are not taking any consideration off the table,&quot; he told reporters in Singapore Tuesday, when asked about the possibility of a cyberattack in the latest incident.

&nbsp;High tensions

Analysts are divided on the issue, with some believing US Navy crews may simply be overstretched as they try to tackle myriad threats in the region, and pointing to the difficulties of sailing through waterways crowded with merchant shipping.

But others believe something more sinister may be going on.&nbsp;

Itar Glick, head of Israeli-based international cybersecurity firm Votiro, said the spate of incidents suggested that US Navy ships&#39; GPS systems could have been tampered with by hackers, causing them to miscalculate their positions.

&quot;I think that hackers could try to do this, and if they are state sponsored they might have the right resources to facilitate this kind of attack,&quot; he told AFP.

Glick, who says he used to work on cybersecurity for Israeli intelligence, said that China and North Korea would be the most likely culprits.

Tensions are running high between North Korea and Washington as Pyongyang makes strides in its weapons programme, conducting two successful intercontinental ballistic missile (ICBM) test launches in July.

Pyongyang has also been blamed for recent cyberattacks, including the 2014 hack of Sony Pictures and the theft of millions of dollars from the Bangladesh central bank.

The US has repeatedly accused China of carrying out cyberattacks on American companies, particularly to steal intellectual property. Beijing however says it is also the victim of such attacks.

&nbsp;&#39;Spoofing&#39;

Glick pointed to a recent incident in June of apparent large-scale GPS interference in the Black Sea to illustrate that such disruptions are possible.

The interference -- known as &quot;spoofing&quot;, which disrupts GPS signals so ships&#39; instruments show inaccurate locations -- caused some 20 vessels to have their signals disrupted, according to reports.

Jeffery Stutzman, chief of intelligence operations for US-based cybersecurity firm Wapack Labs, told AFP he thought the possibility of a cyberattack being behind the latest incident was &quot;entirely possible&quot;.

&quot;I would be very doubtful that it was human error, four times in a row,&quot; he said, referring to the four recent incidents.

Still, other observers believe such a scenario to be unlikely.

Zachary Fryer-Biggs, from defence consultancy Jane&#39;s by IHS Markit, said that even if something went wrong with the GPS system of a ship, other safety mechanisms should stop it from crashing, such as having people on watch.

&quot;The collision only occurs if several other safety mechanisms fail,&quot; he said.

Daniel Paul Goetz, from US-headquartered cybersecurity firm Lantium, added that causing a collision would be complicated, as it would involve knowing the exact location, speed and bearing of both ships involved.

Goetz, who says his background is in US military intelligence, also pointed to the level of technology used to protect the navy from such threats.

&quot;The US military uses a GPS system that is highly secured, highly encrypted -- the chances that somebody could take over US military ship is very close to zero,&quot; he said.

The Chief of US Naval Operations Admiral John Richardson said on Monday he could not rule out some kind of outside interference or a cyberattack being behind the latest collision, but said he did not want to prejudge the inquiry

A spate of incidents involving US warships in Asia, including a deadly collision this week off Singapore, has forced the navy to consider whether cyberattackers might be to blame. While some experts believe that being able to engineer such a collision would be unlikely, given the security systems of the US Navy and the logistics of having two ships converge, others say putting the recent incidents down to human error and coincidence is an equally unsatisfactory explanation. The USS John S. McCain collided with a tanker early Monday as the warship was on its way for a routine stop in the city-state, tearing a huge hole in the hull and leaving 10 sailors missing and five injured. The Navy announced Tuesday that remains of some of the sailors were found by divers in flooded compartments on the ship. The Chief of US Naval Operations Admiral John Richardson said on Monday he could not rule out some kind of outside interference or a cyberattack being behind the latest collision, but said he did not want to prejudge the inquiry. His broader remarks suggested a focus on "how we do business on the bridge". "We're looking at every possibility," Richardson said, when asked about the possibility of a cyberattack, adding "as we did with Fitzgerald as well." Just two months earlier in June, the USS Fitzgerald and a Philippine-flagged cargo ship smashed into each other off Japan, leaving seven sailors dead and leading to several officers being disciplined. There were also two more, lesser-known incidents this year -- in January USS Antietam ran aground near its base in Japan and in May, USS Lake Champlain collided with a South Korean fishing vessel. Neither caused any injury. Admiral Scott Swift, commander of the US Pacific Fleet, has refused to rule out sabotage in Monday's incident, saying all possibilities are being examined. "We are not taking any consideration off the table," he told reporters in Singapore Tuesday, when asked about the possibility of a cyberattack in the latest incident. High tensions Analysts are divided on the issue, with some believing US Navy crews may simply be overstretched as they try to tackle myriad threats in the region, and pointing to the difficulties of sailing through waterways crowded with merchant shipping. But others believe something more sinister may be going on. Itar Glick, head of Israeli-based international cybersecurity firm Votiro, said the spate of incidents suggested that US Navy ships' GPS systems could have been tampered with by hackers, causing them to miscalculate their positions. "I think that hackers could try to do this, and if they are state sponsored they might have the right resources to facilitate this kind of attack," he told AFP. Glick, who says he used to work on cybersecurity for Israeli intelligence, said that China and North Korea would be the most likely culprits. Tensions are running high between North Korea and Washington as Pyongyang makes strides in its weapons programme, conducting two successful intercontinental ballistic missile (ICBM) test launches in July. Pyongyang has also been blamed for recent cyberattacks, including the 2014 hack of Sony Pictures and the theft of millions of dollars from the Bangladesh central bank. The US has repeatedly accused China of carrying out cyberattacks on American companies, particularly to steal intellectual property. Beijing however says it is also the victim of such attacks. 'Spoofing' Glick pointed to a recent incident in June of apparent large-scale GPS interference in the Black Sea to illustrate that such disruptions are possible. The interference -- known as "spoofing", which disrupts GPS signals so ships' instruments show inaccurate locations -- caused some 20 vessels to have their signals disrupted, according to reports. Jeffery Stutzman, chief of intelligence operations for US-based cybersecurity firm Wapack Labs, told AFP he thought the possibility of a cyberattack being behind the latest incident was "entirely possible". "I would be very doubtful that it was human error, four times in a row," he said, referring to the four recent incidents. Still, other observers believe such a scenario to be unlikely. Zachary Fryer-Biggs, from defence consultancy Jane's by IHS Markit, said that even if something went wrong with the GPS system of a ship, other safety mechanisms should stop it from crashing, such as having people on watch. "The collision only occurs if several other safety mechanisms fail," he said. Daniel Paul Goetz, from US-headquartered cybersecurity firm Lantium, added that causing a collision would be complicated, as it would involve knowing the exact location, speed and bearing of both ships involved. Goetz, who says his background is in US military intelligence, also pointed to the level of technology used to protect the navy from such threats. "The US military uses a GPS system that is highly secured, highly encrypted -- the chances that somebody could take over US military ship is very close to zero," he said.

Did cyberattacks cause US warship collisions?

The Indian Prime Minister Narendra Modi&#39;s visit to Israel is historic in many ways. The fact that PM Modi is the first Indian &nbsp;prime minister to visit Israel in the last 70 years, foreign policy experts interpret this as a signal that both the national governments are willing to write a new chapter by overriding any &lsquo;historical baggage&rsquo;. Evidently, the dynamics of the bilateral relationship will be premised on&nbsp;further deepening the existing ties in matters related to defence, agriculture, trade, diplomacy and water management. At outset, it was made clear&nbsp;by Prime Minister Netanyahu of Israel that Indian talents and Israel technologies should write the future of growth. India not only needs Israel technologies for its&nbsp;&quot;Make in India&quot; campaign but also to promote&nbsp;Digital India and reinventing Agri(culture-digital) India.

Israel&#39;s&nbsp;technological prowess is&nbsp;so crucial to India because both countries have geopolitical and domestic imperatives, a <a href="https://thewire.in/88698/emergence-reluctant-digital-power/">reluctant digital power</a> (India) needs a strong support from a <a href="http://www.barlaw.co.il/blog/from-a-start-up-nation-to-a-cyber-security-nation-the-evolution-of-israel-as-a-security-leader/">cyber power</a> (Israel) to edge out any cyber geopolitics in South Asia. &nbsp; &nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>India not only needs Israel technologies in Make in India but also in Digital India and reinventing Agri(culture-digital) India.</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=India not only needs Israel technologies in Make in India but also in Digital India and reinventing Agri(culture-digital) India." target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

Cyber Camaraderie&nbsp;

While addressing the Cyber Week 2017, the seventh edition of an annual cybersecurity conference held at Tel Aviv University in Israel on&nbsp;June, PM Benjamin Netanyahu said that cyber security is one of the key areas of cooperation to be discussed with PM Narendra Modi.&nbsp;

Indo-Israel cyber camaraderie is need of the hour, particularly because Israel has world&rsquo;s largest cyber security industry after the US.&nbsp;Many Israeli companies having a growing&nbsp;role in cyber defence technology, research and development, encryption and data protection. After China, India has the world&rsquo;s largest number of Internet users, but the digital ecosystem available to Indian users is prone to attack, and that makes Digital India initiative vulnerable.&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>Israel has world&rsquo;s largest cyber security industry and many Israeli companies having a protuberant role in cyber defence technology, research and development, encryption and data protection.</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=Israel has world?s largest cyber security industry and many Israeli companies having a protuberant role in cyber defence technology, research and development, encryption and data protection." target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

Bishop to Bishop 1- India has ranked <a href="http://timesofindia.indiatimes.com/business/india-business/india-ranks-4th-in-online-security-breaches/articleshow/58408905.cms">4th</a> in cyber security breaches and <a href="http://www.dnaindia.com/money/interview-india-ranked-fifth-in-ransomware-attacks-in-2016-pankit-desai-2438345">5th</a> in ransomware attacks. Statistically speaking,&nbsp;the costs of cyber threats are spurring up very quickly. For instance, the insane cyber attack on <a href="https://www.wired.com/2016/05/insane-81m-bangladesh-bank-heist-heres-know/">Bangladesh Bank</a> costs $ 81 million and&nbsp;in 2014, the <a href="http://www.reuters.com/article/us-sony-cybersecurity-costs-idUSKBN0JN2L020141209">cyber attack on Sony</a> studio was $100 million.&nbsp;More recently, the outbreak of WannaCry ransomware attack cost the world&nbsp;$4 billion. Cyber frauds carried out&nbsp;in India was worth <a href="http://www.thehindu.com/business/Economy/cyber-frauds-cost-india-4-billion/article5261594.ece">$4 billion in 2013</a>&nbsp;alone, and there is nothing to root it out yet.

An estimation shows that cybercrime <a href="http://www.cnbc.com/2017/02/07/cybercrime-costs-the-global-economy-450-billion-ceo.html">costs</a> the global economy $450 billion in 2016. Another estimation by the Microsoft underlines that economic loss of cyber crime would reach $3 trillion by 2020, which is just a tip of the larger iceberg. In foreseeable future, it might hold a significant risk to businesses, governments and societies. How should India and Israel address this issue?&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>As per a report, the Israel Defense Forces has 8200, elite cyber offensive and defensive army to address potential cyber threats.</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=As per a report, the Israel Defense Forces has 8200, elite cyber offensive and defensive army to address potential cyber threats." target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

Bishop to Bishop 2 -So far, Israel has been able to subdue&nbsp;its external threats by expanding it&rsquo;s both territorial and cyber capabilities. As per a report, the Israel Defense Forces has 8200 members strong elite cyber offensive and defensive army to address potential cyber threats. On the contrary, due to thin interests in building cyber offensive and defensive mechanisms, India has become a target of cyber attacks mostly generated from <a href="http://gadgets.ndtv.com/internet/news/cyber-attacks-on-india-mostly-from-china-pakistan-prasad-725195">China and Pakistan</a>. How Israel could help India in making so?

Bishop to Bishop 3 &ndash; India needs to move out from the present reluctant position to become a truly digital power. Both India and Israel need to expand their cyber diplomacy and digital economy with likeminded countries to address cyber issues in global level.&nbsp;

Lack of cyber attack attribution is a key factor to the hasty rise of cyber threats and both nations need&nbsp;to consider this while addressing the cyber security issues in a bigger picture.

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>Indo-Israel cyber agreements would promulgate upon win-win theory and it can always be substantiated by the existing sheer trust and strong commitments.</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=Indo-Israel cyber agreements would promulgate upon win-win theory and it can always be substantiated by the existing sheer trust and strong commitments." target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

To counter China and Pakistan both online and offline, PM Modi and his Israeli counterpart should underline strong commitment during this trip. Major areas to look into are: border surveillance preferably by UAVs to avoid human fatalities and cooperation in developing India&#39;s cyber army to protect India&rsquo;s internet ecosystem from external penetrations. There is also a need for bilateral commitments to counter cyber terrorism globally.&nbsp;

In the post demonetisation period, India has eased towards building a&nbsp;digital economy but to become a sustainable cyber player, it needs to bring in an infrastructure ecosystem, capacity building, digital funding, and technology transfer to substantiate domestic projects. Indo-Israel cyber agreements will be&nbsp;promulgated upon a win-win theory, and it can always be substantiated by the existing &nbsp;trust and strong commitments.

To counter China and Pakistan both online and offline, Prime Ministers Modi and Netanyahu should underline strong commitment during this trip

The Indian Prime Minister Narendra Modi's visit to Israel is historic in many ways. The fact that PM Modi is the first Indian prime minister to visit Israel in the last 70 years, foreign policy experts interpret this as a signal that both the national governments are willing to write a new chapter by overriding any ‘historical baggage’. Evidently, the dynamics of the bilateral relationship will be premised on further deepening the existing ties in matters related to defence, agriculture, trade, diplomacy and water management. At outset, it was made clear by Prime Minister Netanyahu of Israel that Indian talents and Israel technologies should write the future of growth. India not only needs Israel technologies for its "Make in India" campaign but also to promote Digital India and reinventing Agri(culture-digital) India. Israel's technological prowess is so crucial to India because both countries have geopolitical and domestic imperatives, a reluctant digital power (India) needs a strong support from a cyber power (Israel) to edge out any cyber geopolitics in South Asia. India not only needs Israel technologies in Make in India but also in Digital India and reinventing Agri(culture-digital) India. × Cyber Camaraderie While addressing the Cyber Week 2017, the seventh edition of an annual cybersecurity conference held at Tel Aviv University in Israel on June, PM Benjamin Netanyahu said that cyber security is one of the key areas of cooperation to be discussed with PM Narendra Modi. Indo-Israel cyber camaraderie is need of the hour, particularly because Israel has world’s largest cyber security industry after the US. Many Israeli companies having a growing role in cyber defence technology, research and development, encryption and data protection. After China, India has the world’s largest number of Internet users, but the digital ecosystem available to Indian users is prone to attack, and that makes Digital India initiative vulnerable. Israel has world’s largest cyber security industry and many Israeli companies having a protuberant role in cyber defence technology, research and development, encryption and data protection. × Bishop to Bishop 1- India has ranked 4th in cyber security breaches and 5th in ransomware attacks. Statistically speaking, the costs of cyber threats are spurring up very quickly. For instance, the insane cyber attack on Bangladesh Bank costs $ 81 million and in 2014, the cyber attack on Sony studio was $100 million. More recently, the outbreak of WannaCry ransomware attack cost the world $4 billion. Cyber frauds carried out in India was worth $4 billion in 2013 alone, and there is nothing to root it out yet. An estimation shows that cybercrime costs the global economy $450 billion in 2016. Another estimation by the Microsoft underlines that economic loss of cyber crime would reach $3 trillion by 2020, which is just a tip of the larger iceberg. In foreseeable future, it might hold a significant risk to businesses, governments and societies. How should India and Israel address this issue? As per a report, the Israel Defense Forces has 8200, elite cyber offensive and defensive army to address potential cyber threats. × Bishop to Bishop 2 -So far, Israel has been able to subdue its external threats by expanding it’s both territorial and cyber capabilities. As per a report, the Israel Defense Forces has 8200 members strong elite cyber offensive and defensive army to address potential cyber threats. On the contrary, due to thin interests in building cyber offensive and defensive mechanisms, India has become a target of cyber attacks mostly generated from China and Pakistan. How Israel could help India in making so? Bishop to Bishop 3 – India needs to move out from the present reluctant position to become a truly digital power. Both India and Israel need to expand their cyber diplomacy and digital economy with likeminded countries to address cyber issues in global level. Lack of cyber attack attribution is a key factor to the hasty rise of cyber threats and both nations need to consider this while addressing the cyber security issues in a bigger picture. Indo-Israel cyber agreements would promulgate upon win-win theory and it can always be substantiated by the existing sheer trust and strong commitments. × To counter China and Pakistan both online and offline, PM Modi and his Israeli counterpart should underline strong commitment during this trip. Major areas to look into are: border surveillance preferably by UAVs to avoid human fatalities and cooperation in developing India's cyber army to protect India’s internet ecosystem from external penetrations. There is also a need for bilateral commitments to counter cyber terrorism globally. In the post demonetisation period, India has eased towards building a digital economy but to become a sustainable cyber player, it needs to bring in an infrastructure ecosystem, capacity building, digital funding, and technology transfer to substantiate domestic projects. Indo-Israel cyber agreements will be promulgated upon a win-win theory, and it can always be substantiated by the existing trust and strong commitments.

Why Israel needs to help India build a cyber army

Operations at one of three terminals at India&#39;s largest container port JNPT, on the outskirts of India&#39;s commercial hub of Mumbai, have been disrupted by the global ransomware attack.

The terminal impacted is operated by Danish shipping giant AP Moller-Maersk, which said that the cyberattack had caused outages in its computer systems globally.

The attack, similar to the ransomware that infected more than 3,00,000 computers last month, also affected computers at Russia&#39;s biggest oil company, Ukranian banks, and multinational firms.

The Indian port has been trying to clear containers manually, but operational capacity has dropped to a third at the terminal, Anil Diggikar, Chairman of Jawaharlal Nehru Port (JNPT), told.&nbsp;

&quot;This is fallout of global cyber attack. We are hopeful that operations will normalise in a day,&quot; he said. &quot;Containers are piling up outside the port due to delay in loading and unloading at Gateway Terminals India.&quot;

The terminal impacted is operated by Danish shipping giant AP Moller-Maersk

Operations at one of three terminals at India's largest container port JNPT, on the outskirts of India's commercial hub of Mumbai, have been disrupted by the global ransomware attack. The terminal impacted is operated by Danish shipping giant AP Moller-Maersk, which said that the cyberattack had caused outages in its computer systems globally. The attack, similar to the ransomware that infected more than 3,00,000 computers last month, also affected computers at Russia's biggest oil company, Ukranian banks, and multinational firms. The Indian port has been trying to clear containers manually, but operational capacity has dropped to a third at the terminal, Anil Diggikar, Chairman of Jawaharlal Nehru Port (JNPT), told. "This is fallout of global cyber attack. We are hopeful that operations will normalise in a day," he said. "Containers are piling up outside the port due to delay in loading and unloading at Gateway Terminals India."

India's largest container port hit by global cyber attack

Ransomware demands which hit a clutch of multinationals are the latest in a wave of international cyberattacks in recent months.&nbsp;

In Europe, Danish sea transport company Maersk, British advertising giant WPP and French industrial group Saint-Gobain all came under attack as did US pharmaceutical group Merck.

The attacking tool is believed to be ransomware of the so-called Petya malware type, which earlier affected firms in Russia including oil giant Rosneft and Ukraine.

The latest wave comes just six weeks after what the EU&#39;s law enforcement agency described as an &quot;unprecedented&quot; attack by WannaCry ransomware which hit more than 100 countries, notably Britain&#39;s National Health Service.

The repeated waves of attacks have raised questions on how companies can protect themselves effectively.

- What is ransomware? -&nbsp; 
Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files.

Ransomware is used on PCs as well as tablets and smartphones. It can affect &quot;at the same time individuals, businesses and institutions,&quot; Amar Zendik, CEO security firm Mind Technologies, told AFP.

How does it work? - 
Cyberpirates generally take control of computers by exploiting flaws on the internet.

That could happen when a user logs onto a website that has been previously infected or opens an email that invites the user to click on a link or download an attachment.

In a few seconds, the malware can be implanted. And when it&#39;s installed, &quot;it can&#39;t be detected,&quot; Laurent Marechal, a cyber security expert at McAfee, said. It&#39;s only afterward that it &quot;downloads the &#39;payload&#39;, that is the viral charge,&quot; he said.

From then on the computer workstation is blocked. &quot;Most often the user has to send an SMS&quot; -- and pay up -- &quot;in order to get the unblocking code,&quot; &nbsp;says Marechal, adding that in certain complex cases, the virus can spread &quot;without any human intervention&quot;.

- Is it used frequently? - 
Yes. And Ransomware continues to multiply. According to security software Kapersky Lab, 62 new types of ransomware were identified last year.

And the US computer security software company McAfee said the number of &quot;samples&quot; detected increased by 88 percent in 2016, totalling some four million.

&quot;Often the pirates ask for small sums of money. But accumulated, these small amounts add up to big money,&quot; says cyber security expert Zendik.

&quot;This is a bit like a flu epidemic in winter,&quot; said Nicolas Duvinage, head of the French military&#39;s digital crime unit. &quot;We will get many of these viral attack waves in coming months,&quot; he added.

&nbsp;System flaw &nbsp;- 
The culprits behind the cyberattacks in May apparently took advantage of a flaw in the Windows operating system, divulged in documents leaked from the US National Security Agency (NSA), according to initial findings.

Zendik said the attack was based on a previously unknown Windows flaw.

&quot;We&#39;re not talking about classic &#39;ransomware&#39; which generally targets individuals and small businesses,&quot; he said.

&quot;Here the hackers attacked big institutions, not likely to be susceptible to paying, especially given the publicity about the operation.&quot;

He added that &quot;in theory, the authors of the attack did not want to make money, but rather to achieve a (cyber) coup.&quot;

- How to protect oneself - 
Several simple rules can be followed to reduce the risks of a ransomware attack.

Among them are regularly updating security software which can correct any flaws exploited by the virus.

In case of a cyberattack, the authorities advise disconnecting the infected equipment immediately from the network.

In the case of a virus affecting a business or an institution, the IT experts should be alerted right away.

Authorities also recommend not paying the hackers the ransom demanded because it&#39;s no guarantee that access to the data will be restored.

Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files

Ransomware demands which hit a clutch of multinationals are the latest in a wave of international cyberattacks in recent months. In Europe, Danish sea transport company Maersk, British advertising giant WPP and French industrial group Saint-Gobain all came under attack as did US pharmaceutical group Merck. The attacking tool is believed to be ransomware of the so-called Petya malware type, which earlier affected firms in Russia including oil giant Rosneft and Ukraine. The latest wave comes just six weeks after what the EU's law enforcement agency described as an "unprecedented" attack by WannaCry ransomware which hit more than 100 countries, notably Britain's National Health Service. The repeated waves of attacks have raised questions on how companies can protect themselves effectively. - What is ransomware? - Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files. Ransomware is used on PCs as well as tablets and smartphones. It can affect "at the same time individuals, businesses and institutions," Amar Zendik, CEO security firm Mind Technologies, told AFP. How does it work? - Cyberpirates generally take control of computers by exploiting flaws on the internet. That could happen when a user logs onto a website that has been previously infected or opens an email that invites the user to click on a link or download an attachment. In a few seconds, the malware can be implanted. And when it's installed, "it can't be detected," Laurent Marechal, a cyber security expert at McAfee, said. It's only afterward that it "downloads the 'payload', that is the viral charge," he said. From then on the computer workstation is blocked. "Most often the user has to send an SMS" -- and pay up -- "in order to get the unblocking code," says Marechal, adding that in certain complex cases, the virus can spread "without any human intervention". - Is it used frequently? - Yes. And Ransomware continues to multiply. According to security software Kapersky Lab, 62 new types of ransomware were identified last year. And the US computer security software company McAfee said the number of "samples" detected increased by 88 percent in 2016, totalling some four million. "Often the pirates ask for small sums of money. But accumulated, these small amounts add up to big money," says cyber security expert Zendik. "This is a bit like a flu epidemic in winter," said Nicolas Duvinage, head of the French military's digital crime unit. "We will get many of these viral attack waves in coming months," he added. System flaw - The culprits behind the cyberattacks in May apparently took advantage of a flaw in the Windows operating system, divulged in documents leaked from the US National Security Agency (NSA), according to initial findings. Zendik said the attack was based on a previously unknown Windows flaw. "We're not talking about classic 'ransomware' which generally targets individuals and small businesses," he said. "Here the hackers attacked big institutions, not likely to be susceptible to paying, especially given the publicity about the operation." He added that "in theory, the authors of the attack did not want to make money, but rather to achieve a (cyber) coup." - How to protect oneself - Several simple rules can be followed to reduce the risks of a ransomware attack. Among them are regularly updating security software which can correct any flaws exploited by the virus. In case of a cyberattack, the authorities advise disconnecting the infected equipment immediately from the network. In the case of a virus affecting a business or an institution, the IT experts should be alerted right away. Authorities also recommend not paying the hackers the ransom demanded because it's no guarantee that access to the data will be restored.

Ransomware, the weapon wielded in cyber attacks

A major global cyber attack on Tuesday disrupted computers at Russia&#39;s biggest oil company, Ukrainian banks and multinational firms with a virus similar to the ransomware that last month infected more than 3,00,000 computers.

The rapidly spreading cyber extortion campaign underscored growing concerns that businesses have failed to secure their networks from increasingly aggressive hackers, who have shown they are capable of shutting down critical infrastructure and crippling corporate and government networks.

It included code known as &quot;Eternal Blue,&quot; which cyber security experts widely believe was stolen from the US National Security Agency (NSA) and was also used in last month&#39;s ransomware attack, named &quot;WannaCry.&quot;

&quot;Cyber attacks can simply destroy us,&quot; said Kevin Johnson, chief executive of cyber security firm Secure Ideas. &quot;Companies are just not doing what they are supposed to do to fix the problem.&quot;

The ransomware virus crippled computers running Microsoft&#39;s Windows by encrypting hard drives and overwriting files, then demanded $300 in bitcoin payments to restore access. More than 30 victims paid into the bitcoin account associated with the attack, according to a public ledger of transactions listed on blockchain.info.

Microsoft said the virus could spread through a flaw that was patched in a security update in March.

&quot;We are continuing to investigate and will take appropriate action to protect customers,&quot; a spokesman for the company said, adding that Microsoft antivirus software detects and removes it.

Russia and Ukraine were most affected by the thousands of attacks, according to security software maker Kaspersky Lab, with other victims spread across countries including Britain, France, Germany, Italy, Poland and the United States. The total number of attacks was unknown.

Security experts said they expected the impact to be smaller than WannaCry since many computers had been patched with Windows updates in the wake of WannaCry last month to protect them against attacks using Eternal Blue code.

Still, the attack could be more dangerous than traditional strains of ransomware because it makes computers unresponsive and unable to reboot, Juniper Networks said in a blog post analysing the attack.

Researchers said the attack may have borrowed malware code used in earlier ransomware campaigns known as &quot;Petya&quot; and &quot;GoldenEye.&quot;

Following last month&#39;s attack, governments, security firms and industrial groups aggressively advised businesses and consumers to make sure all their computers were updated with Microsoft patches to defend against the threat.

The US Department of Homeland Security said it was monitoring the attacks and coordinating with other countries. It advised victims not to pay the extortion, saying that doing so does not guarantee access will be restored.

In a statement, the White House National Security Council said there was currently no risk to public safety. The United States was investigating the attack and determined to hold those responsible accountable, it said.

The NSA did not respond to a request for comment. The spy agency has not publicly said whether it built Eternal Blue and other hacking tools leaked online by an entity known as Shadow Brokers.

Several private security experts have said they believe Shadow Brokers is tied to the Russian government, and that the North Korean government was behind WannaCry. Both countries&#39; governments deny charges they are involved in hacking.

&lsquo;Don&rsquo;t waste your time&rsquo;

The first attacks were reported from Russia and Ukraine.

Russia&#39;s Rosneft, one of the world&#39;s biggest crude producers by volume, said its systems had suffered &quot;serious consequences,&quot; but added oil production had not been affected because it switched over to backup systems.

Ukrainian Deputy Prime Minister Pavlo Rozenko said the government&#39;s computer network went down and the central bank reported disruption to operations at banks and firms including the state power distributor.

Danish shipping giant AP Moller-Maersk said it was among the victims, reporting outages at facilities including its Los Angeles terminal.

WPP, the world&#39;s largest advertising agency, said it was also infected. A WPP employee who asked not to be named said that workers were told to shut down their computers: &quot;The building has come to a standstill.&quot;

A Ukrainian media company said its computers were blocked and it was asked to pay $300 in the crypto-currency bitcoin to regain access.

&quot;Perhaps you are busy looking for a way to recover your files, but don&#39;t waste your time. Nobody can recover your files without our decryption service,&quot; the message said, according to a screenshot posted on Ukraine&#39;s Channel 24.

Russia&#39;s central bank said there were isolated cases of lenders&#39; IT systems being infected. One consumer lender, Home Credit, had to suspend client operations.

Other companies that identified themselves as victims included French construction materials firm Saint Gobain, US drugmaker Merck &amp; Co and Mars Inc&#39;s Royal Canin pet food business.

India-based employees at Beiersdorf, makers of Nivea skin care products, and Reckitt Benckiser, which owns Enfamil and Lysol, told Reuters the ransomware attack had impacted some of their systems in the country.

Western Pennsylvania&#39;s Heritage Valley Health System&#39;s entire network was shut down by a cyber attack on Tuesday, according to local media reports.

Last&#39;s month&#39;s fast-spreading WannaCry ransomware attack was crippled after a 22-year-old British security researcher Marcus Hutchins created a so-called &quot;kill switch&quot; that experts hailed as the decisive step in slowing the attack.

Security experts said they did not believe that the ransomware released on Tuesday had a kill switch, meaning that it might be harder to stop.

Ukraine&#39;s cyber police said on Twitter that a vulnerability in software used by MEDoc, a Ukrainian accounting firm, may have been an initial source of the virus, which researchers including cyber intelligence firm Flashpoint said could have infected victims via an illegitimate software update.

In a Facebook post, MEDoc confirmed it had been hacked but denied responsibility for originating the attack. 
An adviser to Ukraine&#39;s interior minister said earlier in the day that the virus got into computer systems via &quot;phishing&quot; emails written in Russian and Ukrainian designed to lure employees into opening them.

According to the state security agency, the emails contained infected Word documents or PDF files as attachments.

&nbsp;

The rapidly spreading cyber extortion campaign underscores growing concerns that businesses have failed to secure their networks

A major global cyber attack on Tuesday disrupted computers at Russia's biggest oil company, Ukrainian banks and multinational firms with a virus similar to the ransomware that last month infected more than 3,00,000 computers. The rapidly spreading cyber extortion campaign underscored growing concerns that businesses have failed to secure their networks from increasingly aggressive hackers, who have shown they are capable of shutting down critical infrastructure and crippling corporate and government networks. It included code known as "Eternal Blue," which cyber security experts widely believe was stolen from the US National Security Agency (NSA) and was also used in last month's ransomware attack, named "WannaCry." "Cyber attacks can simply destroy us," said Kevin Johnson, chief executive of cyber security firm Secure Ideas. "Companies are just not doing what they are supposed to do to fix the problem." The ransomware virus crippled computers running Microsoft's Windows by encrypting hard drives and overwriting files, then demanded $300 in bitcoin payments to restore access. More than 30 victims paid into the bitcoin account associated with the attack, according to a public ledger of transactions listed on blockchain.info. Microsoft said the virus could spread through a flaw that was patched in a security update in March. "We are continuing to investigate and will take appropriate action to protect customers," a spokesman for the company said, adding that Microsoft antivirus software detects and removes it. Russia and Ukraine were most affected by the thousands of attacks, according to security software maker Kaspersky Lab, with other victims spread across countries including Britain, France, Germany, Italy, Poland and the United States. The total number of attacks was unknown. Security experts said they expected the impact to be smaller than WannaCry since many computers had been patched with Windows updates in the wake of WannaCry last month to protect them against attacks using Eternal Blue code. Still, the attack could be more dangerous than traditional strains of ransomware because it makes computers unresponsive and unable to reboot, Juniper Networks said in a blog post analysing the attack. Researchers said the attack may have borrowed malware code used in earlier ransomware campaigns known as "Petya" and "GoldenEye." Following last month's attack, governments, security firms and industrial groups aggressively advised businesses and consumers to make sure all their computers were updated with Microsoft patches to defend against the threat. The US Department of Homeland Security said it was monitoring the attacks and coordinating with other countries. It advised victims not to pay the extortion, saying that doing so does not guarantee access will be restored. In a statement, the White House National Security Council said there was currently no risk to public safety. The United States was investigating the attack and determined to hold those responsible accountable, it said. The NSA did not respond to a request for comment. The spy agency has not publicly said whether it built Eternal Blue and other hacking tools leaked online by an entity known as Shadow Brokers. Several private security experts have said they believe Shadow Brokers is tied to the Russian government, and that the North Korean government was behind WannaCry. Both countries' governments deny charges they are involved in hacking. ‘Don’t waste your time’ The first attacks were reported from Russia and Ukraine. Russia's Rosneft, one of the world's biggest crude producers by volume, said its systems had suffered "serious consequences," but added oil production had not been affected because it switched over to backup systems. Ukrainian Deputy Prime Minister Pavlo Rozenko said the government's computer network went down and the central bank reported disruption to operations at banks and firms including the state power distributor. Danish shipping giant AP Moller-Maersk said it was among the victims, reporting outages at facilities including its Los Angeles terminal. WPP, the world's largest advertising agency, said it was also infected. A WPP employee who asked not to be named said that workers were told to shut down their computers: "The building has come to a standstill." A Ukrainian media company said its computers were blocked and it was asked to pay $300 in the crypto-currency bitcoin to regain access. "Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service," the message said, according to a screenshot posted on Ukraine's Channel 24. Russia's central bank said there were isolated cases of lenders' IT systems being infected. One consumer lender, Home Credit, had to suspend client operations. Other companies that identified themselves as victims included French construction materials firm Saint Gobain, US drugmaker Merck & Co and Mars Inc's Royal Canin pet food business. India-based employees at Beiersdorf, makers of Nivea skin care products, and Reckitt Benckiser, which owns Enfamil and Lysol, told Reuters the ransomware attack had impacted some of their systems in the country. Western Pennsylvania's Heritage Valley Health System's entire network was shut down by a cyber attack on Tuesday, according to local media reports. Last's month's fast-spreading WannaCry ransomware attack was crippled after a 22-year-old British security researcher Marcus Hutchins created a so-called "kill switch" that experts hailed as the decisive step in slowing the attack. Security experts said they did not believe that the ransomware released on Tuesday had a kill switch, meaning that it might be harder to stop. Ukraine's cyber police said on Twitter that a vulnerability in software used by MEDoc, a Ukrainian accounting firm, may have been an initial source of the virus, which researchers including cyber intelligence firm Flashpoint said could have infected victims via an illegitimate software update. In a Facebook post, MEDoc confirmed it had been hacked but denied responsibility for originating the attack. An adviser to Ukraine's interior minister said earlier in the day that the virus got into computer systems via "phishing" emails written in Russian and Ukrainian designed to lure employees into opening them. According to the state security agency, the emails contained infected Word documents or PDF files as attachments.

New cyber attack, similar to 'WannaCry', sweeps globe - once again

Britain&#39;s parliament was hit by a &quot;sustained and determined&quot; cyber attack on Saturday designed to identify weak email passwords, just over a month after a ransomware worm crippled parts of the country&#39;s health service.

The House of Commons said it was working with the National Cyber Security Centre to defend parliament&#39;s network and was confident it had protected all accounts and systems.

&quot;Earlier this morning we discovered unusual activity and evidence of an attempted cyber-attack on our computer network,&quot; an email sent by parliamentary authorities to those people affected said.

&quot;Closer investigation by our team confirmed that hackers were carrying out a sustained and determined attack on all parliamentary user accounts in an attempt to identify weak passwords.&quot;

Britain&#39;s National Health Service was hit by a massive global ransomware worm in May which crippled the computer system and forced some hospitals to turn away patients.

The National Cyber Security centre is part of Britain&#39;s GCHQ spy agency, set up last year to tackle what the government believes is one of the biggest threats to British security.

Chris Rennard, a member of the Liberal Democrat party in the upper House of Lords, was the first to draw attention to the problem, using Twitter to announce: &quot;Cyber security attack on Westminster, Parliamentary emails may not work remotely, Text urgent messages.&quot;

A spokeswoman for the House of Commons confirmed that unauthorised attempts had been made to access parliamentary accounts and said systems were in place to protect member and staff details.

&quot;As a precaution, we have temporarily restricted remote access to the network,&quot; she said. &quot;As a result, some Members of Parliament and staff cannot access their email accounts outside of Westminster.&quot;

Liam Fox, the minister for international trade, said the attack was not a surprise and should act as a warning to people across the country to the threat posed by cyber hackers.

&quot;We&#39;ve seen reports in the last few days of even cabinet ministers&#39; passwords being for sale online,&quot; he told broadcasters.

&quot;We know that our public services are attacked so it&#39;s not at all surprising that there should be an attempt to hack into parliamentary emails.&quot;

Britain's parliament was hit by a 'sustained and determined' cyber attack on Saturday designed to identify weak email passwords

Britain's parliament was hit by a "sustained and determined" cyber attack on Saturday designed to identify weak email passwords, just over a month after a ransomware worm crippled parts of the country's health service. The House of Commons said it was working with the National Cyber Security Centre to defend parliament's network and was confident it had protected all accounts and systems. "Earlier this morning we discovered unusual activity and evidence of an attempted cyber-attack on our computer network," an email sent by parliamentary authorities to those people affected said. "Closer investigation by our team confirmed that hackers were carrying out a sustained and determined attack on all parliamentary user accounts in an attempt to identify weak passwords." Britain's National Health Service was hit by a massive global ransomware worm in May which crippled the computer system and forced some hospitals to turn away patients. The National Cyber Security centre is part of Britain's GCHQ spy agency, set up last year to tackle what the government believes is one of the biggest threats to British security. Chris Rennard, a member of the Liberal Democrat party in the upper House of Lords, was the first to draw attention to the problem, using Twitter to announce: "Cyber security attack on Westminster, Parliamentary emails may not work remotely, Text urgent messages." A spokeswoman for the House of Commons confirmed that unauthorised attempts had been made to access parliamentary accounts and said systems were in place to protect member and staff details. "As a precaution, we have temporarily restricted remote access to the network," she said. "As a result, some Members of Parliament and staff cannot access their email accounts outside of Westminster." Liam Fox, the minister for international trade, said the attack was not a surprise and should act as a warning to people across the country to the threat posed by cyber hackers. "We've seen reports in the last few days of even cabinet ministers' passwords being for sale online," he told broadcasters. "We know that our public services are attacked so it's not at all surprising that there should be an attempt to hack into parliamentary emails."

British Parliament hit by 'sustained' cyberattack

British Airways has&nbsp;cancelled all flights out of major London airports Heathrow and Gatwick for the rest of Saturday after an IT systems failure.

The airline had earlier said all flights from the two airports had been cancelled up to 6.00 pm (1700 GMT), but a spokesman later told AFP that all flights for Saturday had been grounded.

The latest IT failure comes just a few weeks after the ransomware attack which had <a href="http://www.wionews.com/world/multiple-countries-reporting-ransomware-cyber-attacks-15509">paralysed&nbsp;Britain&#39;s health services for several hours</a>.&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
We apologise for the current IT systems outage. We are working to resolve the problem as quickly as possible.
&mdash; British Airways (@British_Airways) <a href="https://twitter.com/British_Airways/status/868403485729071104">May 27, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

The airline said it had found &quot;no evidence that it&#39;s a cyber attack&quot;.&nbsp;

&quot;We have experienced a major IT system failure that is causing very severe disruption to our flight operations worldwide,&quot; BA said in a statement.

&quot;The terminals at Heathrow and Gatwick have become extremely congested and we have cancelled all flights from Heathrow and Gatwick before 6.00 pm UK time today (1700 GMT), so please do not come to the airports.&quot;

The airline had suffered previous IT glitches, with passengers hit by severe delays in July and September last year.&nbsp;

Distressed&nbsp;passengers immediately took to Twitter expressing their discomfort, several said&nbsp;that they were unable to check in or use the airline&#39;s app while others were left grounded on the tarmac.

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
Chaos at Heathrow - BA system problems apparently so severe that staff having to write gate information on white boards (pic: <a href="https://twitter.com/theboyg">@theboyg</a>) <a href="https://t.co/0nGX16QH5F">pic.twitter.com/0nGX16QH5F</a>
&mdash; Stephen Jones (@SteveJonesPA) <a href="https://twitter.com/SteveJonesPA/status/868412388235763713">May 27, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

(WION with AFP inputs)

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="videos-block">
<div class="embed-responsive embed-responsive-16by9"><iframe class="embed-responsive-item" src="https://www.youtube.com/embed/S8bzSmyg0fQ"></iframe></div>
</div>

<div class="media-description">
British Airways flights in Britain were being delayed and passengers were suffering long waits at airports on Saturday because of an IT system failure (WION)
</div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

&nbsp;

British Airways said it had found "no evidence that it's a cyber attack

British Airways has cancelled all flights out of major London airports Heathrow and Gatwick for the rest of Saturday after an IT systems failure. The airline had earlier said all flights from the two airports had been cancelled up to 6.00 pm (1700 GMT), but a spokesman later told AFP that all flights for Saturday had been grounded. The latest IT failure comes just a few weeks after the ransomware attack which had paralysed Britain's health services for several hours. We apologise for the current IT systems outage. We are working to resolve the problem as quickly as possible. — British Airways (@British_Airways) May 27, 2017 × The airline said it had found "no evidence that it's a cyber attack". "We have experienced a major IT system failure that is causing very severe disruption to our flight operations worldwide," BA said in a statement. "The terminals at Heathrow and Gatwick have become extremely congested and we have cancelled all flights from Heathrow and Gatwick before 6.00 pm UK time today (1700 GMT), so please do not come to the airports." The airline had suffered previous IT glitches, with passengers hit by severe delays in July and September last year. Distressed passengers immediately took to Twitter expressing their discomfort, several said that they were unable to check in or use the airline's app while others were left grounded on the tarmac. Chaos at Heathrow - BA system problems apparently so severe that staff having to write gate information on white boards (pic: @theboyg) pic.twitter.com/0nGX16QH5F — Stephen Jones (@SteveJonesPA) May 27, 2017 × (WION with AFP inputs) British Airways flights in Britain were being delayed and passengers were suffering long waits at airports on Saturday because of an IT system failure (WION) ×

British Airways cancels all Saturday flights from London's Heathrow, Gatwick after IT failure

Cyber security firm Symantec said it was &quot;highly likely&quot; a hacking group affiliated with North Korea was behind the WannaCry cyber attack this month that infected more than 300,000 computers worldwide and disrupted hospitals, banks and schools across the globe.

Symantec researchers said they had found multiple instances of code that had been used both in the North Korea-linked group&#39;s previous activity and in early versions of WannaCry.

In addition, the same Internet connection was used to install an early version of WannaCry on two computers and to communicate with a tool that destroyed files at Sony Pictures Entertainment. The US&nbsp;government and private companies have accused North Korea in the 2014 Sony attack.

North Korea has routinely denied any such role. On Monday, it called earlier reports that it might have been behind the WannaCry attack &quot;a dirty and despicable smear campaign.&quot;

Lazarus is the name many security companies have given to the hacking group behind the Sony attack and others. By custom, Symantec does not attribute cyber campaigns directly to governments, but its researchers did not dispute the common belief that Lazarus works for North Korea.

In a blog post, Symantec listed numerous links between Lazarus and software the group had left behind after launching an earlier, less virulent, version of the malware in February. One was a variant of software used to wipe disks during the Sony Pictures attack, while another tool used the same internet addresses as two other pieces of malware linked to Lazarus.

At the same time, flaws in the WannaCry code, its wide spread, and its demands for payment in the electronic bitcoin before files are decrypted suggest that the hackers were not working for North Korean government objectives in this case, said Vikram Thakur, Symantec&#39;s security response technical director.

&quot;Our confidence is very high that this is the work of people associated with the Lazarus Group, because they had to have source code access,&quot; Thakur said in an interview.

But he added: &quot;We don&#39;t think that this is an operation run by a nation-state.&quot;

With WannaCry, Thakur said, Lazarus Group members could have been moonlighting to make extra money, or they could have left government service, or they could have been contractors without direct obligations to serve only the government.

The most effective version of WannaCry spread by using a flaw in Microsoft&#39;s Windows and a program that took advantage of it that had been used by the US&nbsp;National Security Agency, officials said privately.

That program was among a batch leaked or stolen and then dumped online by a group calling itself The Shadow Brokers, who some in US&nbsp;intelligence believe to be affiliated with Russia.

Analysts have been weighing in with various theories on the identity of those behind WannaCry, and some early evidence had pointed to North Korea. The Shadow Brokers endorsed that theory, perhaps to take heat off their own government backers for the disaster.

Cybersecurity company Kaspersky has said it had found several similarities between the WannaCry malware from the earlier attack and those used by Lazarus. But in an interview last week, its Asia research director, Vitaly Kamluk, said it was not conclusive evidence. &quot;It&#39;s unusual,&quot; he said.

Beau Woods, deputy director of the Cyber Statecraft Initiative at the Atlantic Council, said that the Korean language used in some versions of the WannaCry ransom note was not that of a native speaker, making a Lazarus connection unlikely.

But Thakur said that some hackers deliberately obfuscate their language to make tracing them harder. It is also possible that the writer in question was a contractor in another country, he said.

Thakur said a less likely scenario is that Lazarus&#39; main aim was to create chaos by distributing WannaCry.

If the hackers&#39; main objective was to earn money on the side, that would suggest an undisciplined hacking operation run by North Korea, one that could be exploited and weakened by the country&#39;s many foes.

&quot;The intelligence community will probably take away from this that there is a possibility of splinters in the Lazarus Group, or members who are interested in filling their own pockets, and that could help,&quot; Thakur said.

Lazarus has also been linked to attacks on banks using their SWIFT messaging network. Last year, hackers stole $81 million from Bangladesh&#39;s central bank. Symantec said malware used in that attack was linked to Lazarus.

(Reuters)

Symantec researchers have found multiple instances of code used both in the North Korea-linked group's previous activity and in early versions of WannaCry

Cyber security firm Symantec said it was "highly likely" a hacking group affiliated with North Korea was behind the WannaCry cyber attack this month that infected more than 300,000 computers worldwide and disrupted hospitals, banks and schools across the globe. Symantec researchers said they had found multiple instances of code that had been used both in the North Korea-linked group's previous activity and in early versions of WannaCry. In addition, the same Internet connection was used to install an early version of WannaCry on two computers and to communicate with a tool that destroyed files at Sony Pictures Entertainment. The US government and private companies have accused North Korea in the 2014 Sony attack. North Korea has routinely denied any such role. On Monday, it called earlier reports that it might have been behind the WannaCry attack "a dirty and despicable smear campaign." Lazarus is the name many security companies have given to the hacking group behind the Sony attack and others. By custom, Symantec does not attribute cyber campaigns directly to governments, but its researchers did not dispute the common belief that Lazarus works for North Korea. In a blog post, Symantec listed numerous links between Lazarus and software the group had left behind after launching an earlier, less virulent, version of the malware in February. One was a variant of software used to wipe disks during the Sony Pictures attack, while another tool used the same internet addresses as two other pieces of malware linked to Lazarus. At the same time, flaws in the WannaCry code, its wide spread, and its demands for payment in the electronic bitcoin before files are decrypted suggest that the hackers were not working for North Korean government objectives in this case, said Vikram Thakur, Symantec's security response technical director. "Our confidence is very high that this is the work of people associated with the Lazarus Group, because they had to have source code access," Thakur said in an interview. But he added: "We don't think that this is an operation run by a nation-state." With WannaCry, Thakur said, Lazarus Group members could have been moonlighting to make extra money, or they could have left government service, or they could have been contractors without direct obligations to serve only the government. The most effective version of WannaCry spread by using a flaw in Microsoft's Windows and a program that took advantage of it that had been used by the US National Security Agency, officials said privately. That program was among a batch leaked or stolen and then dumped online by a group calling itself The Shadow Brokers, who some in US intelligence believe to be affiliated with Russia. Analysts have been weighing in with various theories on the identity of those behind WannaCry, and some early evidence had pointed to North Korea. The Shadow Brokers endorsed that theory, perhaps to take heat off their own government backers for the disaster. Cybersecurity company Kaspersky has said it had found several similarities between the WannaCry malware from the earlier attack and those used by Lazarus. But in an interview last week, its Asia research director, Vitaly Kamluk, said it was not conclusive evidence. "It's unusual," he said. Beau Woods, deputy director of the Cyber Statecraft Initiative at the Atlantic Council, said that the Korean language used in some versions of the WannaCry ransom note was not that of a native speaker, making a Lazarus connection unlikely. But Thakur said that some hackers deliberately obfuscate their language to make tracing them harder. It is also possible that the writer in question was a contractor in another country, he said. Thakur said a less likely scenario is that Lazarus' main aim was to create chaos by distributing WannaCry. If the hackers' main objective was to earn money on the side, that would suggest an undisciplined hacking operation run by North Korea, one that could be exploited and weakened by the country's many foes. "The intelligence community will probably take away from this that there is a possibility of splinters in the Lazarus Group, or members who are interested in filling their own pockets, and that could help," Thakur said. Lazarus has also been linked to attacks on banks using their SWIFT messaging network. Last year, hackers stole $81 million from Bangladesh's central bank. Symantec said malware used in that attack was linked to Lazarus. (Reuters)

Symantec says 'highly likely' North Korea group behind ransomware attacks

Russian cyber criminals used malware planted on Android mobile devices to steal from domestic bank customers and were planning to target European lenders before their arrest, investigators and sources with knowledge of the case told Reuters.

Their campaign raised a relatively small sum by cyber-crime standards - more than 50 million roubles ($892,000) - but they had also obtained more sophisticated malicious software for a modest monthly fee to go after the clients of banks in France and possibly a range of other western nations.

Russia&#39;s relationship to cyber crime is under intense scrutiny after US&nbsp;intelligence officials alleged that Russian hackers had tried to help Republican Donald Trump win the U.S. presidency by hacking Democratic Party servers.

The Kremlin has repeatedly denied the allegation.

The gang members tricked the Russian banks&#39; customers into downloading malware via fake mobile banking applications, as well as via pornography and e-commerce programs, according to a report compiled by cyber security firm Group-IB which investigated the attack with the Russian Interior Ministry.

The criminals - 16 suspects were arrested by Russian law enforcement authorities in November last year - infected more than a million smartphones in Russia, on average compromising 3,500 devices a day, Group-IB said.

The hackers targeted customers of state lender Sberbank, and also stole money from accounts at Alfa Bank and online payments company Qiwi, exploiting weaknesses in the companies&#39; SMS text message transfer services, said two people with direct knowledge of the case.

Although operating only in Russia before their arrest, they had developed plans to target large European banks including French lenders Credit Agricole, BNP Paribas and Societe General, Group-IB said.

A BNP Paribas spokeswoman said the bank could not confirm this information, but added that it &quot;has a significant set of measures in place aimed at fighting cyber attacks on a daily basis&quot;. Societe General and Credit Agricole declined comment.

The gang, which was called &quot;Cron&quot; after the malware it used, did not steal any funds from customers of the three French banks. However, it exploited the bank service in Russia that allows users to transfer small sums to other accounts by sending an SMS message.

Having infected the users&#39; phones, the gang sent SMS messages from those devices instructing the banks to transfer money to the hackers&#39; own accounts.

The findings illustrate the dangers of using SMS messages for mobile banking, a method favored in emerging countries with less advanced internet infrastructure, said Lukas Stefanko, a malware researcher at cyber security firm ESET in Slovakia.

&quot;It&#39;s becoming popular among developing nations or in the countryside where access to conventional banking is difficult for people,&quot; he said. &quot;For them it is quick, easy and they don&#39;t need to visit a bank... But security always has to outweigh consumer convenience.&quot;

Cyber criminals

The Russian Interior Ministry said a number of people had been arrested, including what it described as the gang leader. This was a 30-year-old man living in Ivanovo, an industrial city 300 km (185 miles) northeast of Moscow, from where he had commanded a team of 20 people across six different regions.

Four people remain in detention while the others are under house arrest, the ministry said in a statement.

&quot;In the course of 20 searches across six regions, police seized computers, hundreds of bank cards and SIM cards registered under fake names,&quot; it said.

Group-IB said the existence of the Cron malware was first detected in mid-2015, and by the time of the arrests the hackers had been using it for under a year.

The core members of the group were detained on Nov. 22 last year in Ivanovo. Photographs of the operation released by Group-IB showed one suspect face down in the snow as police in ski masks handcuffed him.

The &quot;Cron&quot; hackers were arrested before they could mount attacks outside Russia, but plans to do that were at an advanced stage, said the investigators.

Group-IB said that in June 2016 they had rented a piece of malware designed to attack mobile banking systems, called &quot;Tiny.z&quot; for $2,000 a month. The creators of the &quot;Tiny.z&quot; malware had adapted it to attack banks in Britain, Germany, France, the United States and Turkey, among other countries.

The &quot;Cron&quot; gang developed software designed to attack lenders including the three French groups, it said, adding it had notified these and other European banks at risk.

A spokeswoman for Sberbank said she had no information about the group involved. However, she said: &quot;Several groups of cyber criminals are working against Sberbank. The number of groups and the methods they use to attack us change constantly.&quot;

&quot;It isn&#39;t clear which specific group is being referred to here because the fraudulent scheme involving Android OS (operating system) viruses is widespread in Russia and Sberbank has effectively combated it for an extensive period of time.&quot;

Alfa Bank did not provide a comment. Qiwi did not respond to multiple requests for comment.

Google, the maker of Android, has taken steps in recent years to protect users from downloading malicious code and by blocking apps which are insecure, impersonate legitimate companies or engage in deceptive behaviors.

The company declined to comment for this story, saying they had not seen the Group-IB report.

Fake mobile apps

The Russian authorities, bombarded with allegations of state-sponsored hacking, are keen to show Russia too is a frequent victim of cyber crime and that they are working hard to combat it. The interior and emergencies ministries, as well as Sberbank, said they were targeted in a global cyberattack earlier this month.

Since the allegations about the US&nbsp;election hacking, further evidence has emerged of what some Western officials say is a symbiotic relationship between cyber criminals and Russian authorities, with hackers allowed to attack foreign targets with impunity in return for cooperating with the security services while Moscow clamps down on those operating at home.

The success of the Cron gang was facilitated by the popularity of SMS-banking services in Russia, said Dmitry Volkov, head of investigations at Group-IB.

The gang got their malware on to victims&#39; devices by setting up applications designed to mimic banks&#39; genuine apps. When users searched online, the results would suggest the fake app, which they would then download. The hackers also inserted malware into fake mobile apps for well-known pornography sites.

After infecting a customer&#39;s phone, the hackers were able to send a text message to the bank initiating a transfer of up to $120 to one of 6,000 bank accounts set up to receive the fraudulent payments.

The malware would then intercept a confirmation code sent by the bank and block the victim from receiving a message notifying them about the transaction.

&quot;Cron&#39;s success was due to two main factors,&quot; Volkov said. &quot;First, the large-scale use of partner programs to distribute the malware in different ways. Second, the automation of many (mobile) functions which allowed them to carry out the thefts without direct involvement.&quot;

(Reuters)

They had obtained sophisticated malicious software for a modest monthly fee to go after the clients of banks

Russian cyber criminals used malware planted on Android mobile devices to steal from domestic bank customers and were planning to target European lenders before their arrest, investigators and sources with knowledge of the case told Reuters. Their campaign raised a relatively small sum by cyber-crime standards - more than 50 million roubles ($892,000) - but they had also obtained more sophisticated malicious software for a modest monthly fee to go after the clients of banks in France and possibly a range of other western nations. Russia's relationship to cyber crime is under intense scrutiny after US intelligence officials alleged that Russian hackers had tried to help Republican Donald Trump win the U.S. presidency by hacking Democratic Party servers. The Kremlin has repeatedly denied the allegation. The gang members tricked the Russian banks' customers into downloading malware via fake mobile banking applications, as well as via pornography and e-commerce programs, according to a report compiled by cyber security firm Group-IB which investigated the attack with the Russian Interior Ministry. The criminals - 16 suspects were arrested by Russian law enforcement authorities in November last year - infected more than a million smartphones in Russia, on average compromising 3,500 devices a day, Group-IB said. The hackers targeted customers of state lender Sberbank, and also stole money from accounts at Alfa Bank and online payments company Qiwi, exploiting weaknesses in the companies' SMS text message transfer services, said two people with direct knowledge of the case. Although operating only in Russia before their arrest, they had developed plans to target large European banks including French lenders Credit Agricole, BNP Paribas and Societe General, Group-IB said. A BNP Paribas spokeswoman said the bank could not confirm this information, but added that it "has a significant set of measures in place aimed at fighting cyber attacks on a daily basis". Societe General and Credit Agricole declined comment. The gang, which was called "Cron" after the malware it used, did not steal any funds from customers of the three French banks. However, it exploited the bank service in Russia that allows users to transfer small sums to other accounts by sending an SMS message. Having infected the users' phones, the gang sent SMS messages from those devices instructing the banks to transfer money to the hackers' own accounts. The findings illustrate the dangers of using SMS messages for mobile banking, a method favored in emerging countries with less advanced internet infrastructure, said Lukas Stefanko, a malware researcher at cyber security firm ESET in Slovakia. "It's becoming popular among developing nations or in the countryside where access to conventional banking is difficult for people," he said. "For them it is quick, easy and they don't need to visit a bank... But security always has to outweigh consumer convenience." Cyber criminals The Russian Interior Ministry said a number of people had been arrested, including what it described as the gang leader. This was a 30-year-old man living in Ivanovo, an industrial city 300 km (185 miles) northeast of Moscow, from where he had commanded a team of 20 people across six different regions. Four people remain in detention while the others are under house arrest, the ministry said in a statement. "In the course of 20 searches across six regions, police seized computers, hundreds of bank cards and SIM cards registered under fake names," it said. Group-IB said the existence of the Cron malware was first detected in mid-2015, and by the time of the arrests the hackers had been using it for under a year. The core members of the group were detained on Nov. 22 last year in Ivanovo. Photographs of the operation released by Group-IB showed one suspect face down in the snow as police in ski masks handcuffed him. The "Cron" hackers were arrested before they could mount attacks outside Russia, but plans to do that were at an advanced stage, said the investigators. Group-IB said that in June 2016 they had rented a piece of malware designed to attack mobile banking systems, called "Tiny.z" for $2,000 a month. The creators of the "Tiny.z" malware had adapted it to attack banks in Britain, Germany, France, the United States and Turkey, among other countries. The "Cron" gang developed software designed to attack lenders including the three French groups, it said, adding it had notified these and other European banks at risk. A spokeswoman for Sberbank said she had no information about the group involved. However, she said: "Several groups of cyber criminals are working against Sberbank. The number of groups and the methods they use to attack us change constantly." "It isn't clear which specific group is being referred to here because the fraudulent scheme involving Android OS (operating system) viruses is widespread in Russia and Sberbank has effectively combated it for an extensive period of time." Alfa Bank did not provide a comment. Qiwi did not respond to multiple requests for comment. Google, the maker of Android, has taken steps in recent years to protect users from downloading malicious code and by blocking apps which are insecure, impersonate legitimate companies or engage in deceptive behaviors. The company declined to comment for this story, saying they had not seen the Group-IB report. Fake mobile apps The Russian authorities, bombarded with allegations of state-sponsored hacking, are keen to show Russia too is a frequent victim of cyber crime and that they are working hard to combat it. The interior and emergencies ministries, as well as Sberbank, said they were targeted in a global cyberattack earlier this month. Since the allegations about the US election hacking, further evidence has emerged of what some Western officials say is a symbiotic relationship between cyber criminals and Russian authorities, with hackers allowed to attack foreign targets with impunity in return for cooperating with the security services while Moscow clamps down on those operating at home. The success of the Cron gang was facilitated by the popularity of SMS-banking services in Russia, said Dmitry Volkov, head of investigations at Group-IB. The gang got their malware on to victims' devices by setting up applications designed to mimic banks' genuine apps. When users searched online, the results would suggest the fake app, which they would then download. The hackers also inserted malware into fake mobile apps for well-known pornography sites. After infecting a customer's phone, the hackers were able to send a text message to the bank initiating a transfer of up to $120 to one of 6,000 bank accounts set up to receive the fraudulent payments. The malware would then intercept a confirmation code sent by the bank and block the victim from receiving a message notifying them about the transaction. "Cron's success was due to two main factors," Volkov said. "First, the large-scale use of partner programs to distribute the malware in different ways. Second, the automation of many (mobile) functions which allowed them to carry out the thefts without direct involvement." (Reuters)

Hackers hit Russian bank customers, planned international cyber raids

North Korea&#39;s main spy agency has a special cell called Unit 180 that is likely to have launched some of its most daring and successful cyber attacks, according to defectors, officials and internet security experts.

North Korea has been blamed in recent years for a series of online attacks, mostly on financial networks, in the United States, South Korea and over a dozen other countries.

Cyber security researchers have also said they have found technical evidence that could link North Korea with the global WannaCry &quot;ransomware&quot; cyber attack that infected more than 300,000 computers in 150 countries this month. Pyongyang has called the allegation &quot;ridiculous&quot;.

The crux of the allegations against North Korea is its connection to a hacking group called Lazarus that is linked to last year&#39;s $81 million cyber heist at the Bangladesh central bank and the 2014 attack on Sony&#39;s Hollywood studio.

The US&nbsp;government has blamed North Korea for the Sony hack and some US&nbsp;officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft.

No conclusive proof has been provided and no criminal charges have yet been filed. North Korea has also denied being behind the Sony and banking attacks.

North Korea is one of the most closed countries in the world and any details of its clandestine operations are difficult to obtain. But experts who study the reclusive country and defectors who have ended up in South Korea or the West have provided some clues.

Kim Heung-kwang, a former computer science professor in North Korea who defected to the South in 2004 and still has sources inside North Korea, said Pyongyang&#39;s cyber attacks aimed at raising cash are likely organised by Unit 180, a part of the Reconnaissance General Bureau (RGB), its main overseas intelligence agency.

&quot;Unit 180 is engaged in hacking financial institutions (by) breaching and withdrawing money out of bank accounts,&quot; Kim told Reuters. He has previously said that some of his former students have joined North Korea&#39;s Strategic Cyber Command, its cyber-army.

&quot;The hackers go overseas to find somewhere with better internet services than North Korea so as not to leave a trace,&quot; Kim added. He said it was likely they went under the cover of being employees of trading firms, overseas branches of North Korean companies, or joint ventures in China or Southeast Asia.

James Lewis, a North Korea expert at the Washington-based Center for Strategic and International Studies, said Pyongyang first used hacking as a tool for espionage and then political harassment against South Korean and US targets.

&quot;They changed after Sony by using hacking to support criminal activities to generate hard currency for the regime,&quot; he said.

&quot;So far, it&#39;s worked as well or better as drugs, counterfeiting, smuggling &ndash; all their usual tricks,&quot; Lewis said.

Cost-effective, deniable

The US&nbsp;Department of Defense said in a report submitted to Congress last year that North Korea likely &quot;views cyber as a cost-effective, asymmetric, deniable tool that it can employ with little risk from reprisal attacks, in part because its networks are largely separated from the Internet&quot;.

&quot;It is likely to use Internet infrastructure from third-party nations,&quot; the report said.

South Korean officials say they have considerable evidence of North Korea&#39;s cyber warfare operations.

&quot;North Korea is carrying out cyber attacks through third countries to cover up the origin of the attacks and using their information and communication technology infrastructure,&quot; Ahn Chong-ghee, South Korea&#39;s vice foreign minister, told Reuters in written comments.

Besides the Bangladesh Bank heist, he said Pyongyang was also suspected in attacks on banks in the Philippines, Vietnam and Poland.

In June last year, police said the North Korea&nbsp;hacked into more than 140,000 computers at 160 South Korean companies and government agencies, planting malicious code as part of a long-term plan to lay the groundwork for a massive cyber attack on its rival. &nbsp;

North Korea was also suspected of staging cyber attacks against the South Korean nuclear reactor operator in 2014, although it denied any involvement.

That attack was conducted from a base in China, according to Simon Choi, a senior security researcher at Seoul-based anti-virus company Hauri Inc.

&quot;They operate there so that regardless of what kind of project they do, they have Chinese IP addresses,&quot; said Choi, who has conducted extensive research into North Korea&#39;s hacking capabilities.

Malaysia link

Malaysia has also been a base for North Korean cyber operations, according to Yoo Dong-ryul, a former South Korean police researcher who studied North Korean espionage techniques for 25 years.

&quot;They work in trading or IT programming companies on the surface,&quot; Yoo told Reuters. &quot;Some of them run websites and sell game and gambling programs&quot;.

Two IT firms in Malaysia have links to North Korea&#39;s RGB spy agency, according to a Reuters investigation this year, although there was no suggestion either of them was involved in hacking.

Michael Madden, a US-based expert on the North Korean leadership, said Unit 180 was one of many elite cyber warfare groups in the North Korean intelligence community.

&quot;The personnel are recruited from senior middle schools and receive advanced training at some elite training institutions,&quot; Madden told Reuters.

&quot;They have a certain amount of autonomy in their missions and tasking as well,&quot; he said, adding that they could be operating from hotels in China or Eastern Europe.

In the United States, officials said there was no conclusive evidence that North Korea was behind the WannaCry ransomware, but that was no reason to be complacent.

&quot;Whether or not they are directly involved with ransomware doesn&#39;t change the fact that they are a real cyber threat,&quot; said a senior administration official, who spoke on condition of anonymity.

Dmitri Alperovitch, co-founder of prominent US&nbsp;security firm CrowdStrike, added: &quot;Their capabilities have improved steadily over time, and we consider them to be a threat actor that is capable of inflicting significant damage on US&nbsp;private or government networks.&quot;

(Reuters)

Cyber security researchers have found technical evidence to link North Korea with the global WannaCry "ransomware" cyber attack

North Korea's main spy agency has a special cell called Unit 180 that is likely to have launched some of its most daring and successful cyber attacks, according to defectors, officials and internet security experts. North Korea has been blamed in recent years for a series of online attacks, mostly on financial networks, in the United States, South Korea and over a dozen other countries. Cyber security researchers have also said they have found technical evidence that could link North Korea with the global WannaCry "ransomware" cyber attack that infected more than 300,000 computers in 150 countries this month. Pyongyang has called the allegation "ridiculous". The crux of the allegations against North Korea is its connection to a hacking group called Lazarus that is linked to last year's $81 million cyber heist at the Bangladesh central bank and the 2014 attack on Sony's Hollywood studio. The US government has blamed North Korea for the Sony hack and some US officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft. No conclusive proof has been provided and no criminal charges have yet been filed. North Korea has also denied being behind the Sony and banking attacks. North Korea is one of the most closed countries in the world and any details of its clandestine operations are difficult to obtain. But experts who study the reclusive country and defectors who have ended up in South Korea or the West have provided some clues. Kim Heung-kwang, a former computer science professor in North Korea who defected to the South in 2004 and still has sources inside North Korea, said Pyongyang's cyber attacks aimed at raising cash are likely organised by Unit 180, a part of the Reconnaissance General Bureau (RGB), its main overseas intelligence agency. "Unit 180 is engaged in hacking financial institutions (by) breaching and withdrawing money out of bank accounts," Kim told Reuters. He has previously said that some of his former students have joined North Korea's Strategic Cyber Command, its cyber-army. "The hackers go overseas to find somewhere with better internet services than North Korea so as not to leave a trace," Kim added. He said it was likely they went under the cover of being employees of trading firms, overseas branches of North Korean companies, or joint ventures in China or Southeast Asia. James Lewis, a North Korea expert at the Washington-based Center for Strategic and International Studies, said Pyongyang first used hacking as a tool for espionage and then political harassment against South Korean and US targets. "They changed after Sony by using hacking to support criminal activities to generate hard currency for the regime," he said. "So far, it's worked as well or better as drugs, counterfeiting, smuggling – all their usual tricks," Lewis said. Cost-effective, deniable The US Department of Defense said in a report submitted to Congress last year that North Korea likely "views cyber as a cost-effective, asymmetric, deniable tool that it can employ with little risk from reprisal attacks, in part because its networks are largely separated from the Internet". "It is likely to use Internet infrastructure from third-party nations," the report said. South Korean officials say they have considerable evidence of North Korea's cyber warfare operations. "North Korea is carrying out cyber attacks through third countries to cover up the origin of the attacks and using their information and communication technology infrastructure," Ahn Chong-ghee, South Korea's vice foreign minister, told Reuters in written comments. Besides the Bangladesh Bank heist, he said Pyongyang was also suspected in attacks on banks in the Philippines, Vietnam and Poland. In June last year, police said the North Korea hacked into more than 140,000 computers at 160 South Korean companies and government agencies, planting malicious code as part of a long-term plan to lay the groundwork for a massive cyber attack on its rival. North Korea was also suspected of staging cyber attacks against the South Korean nuclear reactor operator in 2014, although it denied any involvement. That attack was conducted from a base in China, according to Simon Choi, a senior security researcher at Seoul-based anti-virus company Hauri Inc. "They operate there so that regardless of what kind of project they do, they have Chinese IP addresses," said Choi, who has conducted extensive research into North Korea's hacking capabilities. Malaysia link Malaysia has also been a base for North Korean cyber operations, according to Yoo Dong-ryul, a former South Korean police researcher who studied North Korean espionage techniques for 25 years. "They work in trading or IT programming companies on the surface," Yoo told Reuters. "Some of them run websites and sell game and gambling programs". Two IT firms in Malaysia have links to North Korea's RGB spy agency, according to a Reuters investigation this year, although there was no suggestion either of them was involved in hacking. Michael Madden, a US-based expert on the North Korean leadership, said Unit 180 was one of many elite cyber warfare groups in the North Korean intelligence community. "The personnel are recruited from senior middle schools and receive advanced training at some elite training institutions," Madden told Reuters. "They have a certain amount of autonomy in their missions and tasking as well," he said, adding that they could be operating from hotels in China or Eastern Europe. In the United States, officials said there was no conclusive evidence that North Korea was behind the WannaCry ransomware, but that was no reason to be complacent. "Whether or not they are directly involved with ransomware doesn't change the fact that they are a real cyber threat," said a senior administration official, who spoke on condition of anonymity. Dmitri Alperovitch, co-founder of prominent US security firm CrowdStrike, added: "Their capabilities have improved steadily over time, and we consider them to be a threat actor that is capable of inflicting significant damage on US private or government networks." (Reuters)

North Korea's Unit 180, the cyber warfare cell worries the West

French researchers said on Friday they had found a last-chance way for technicians to save Windows files encrypted by WannaCry, racing against a deadline as the ransomware threatens to start locking up victims&#39; computers first infected a week ago.

WannaCry, which started to sweep round the globe last Friday and has infected more than 300,000 computers in 150 nations, threatens to lock out victims who have not paid a sum of $300 to $600 within one week of infection.

A loose-knit team of security researchers scattered across the globe said they had collaborated to develop a workaround to unlock the encryption key for files hit in the global attack, which several independent security researchers have confirmed.

The researchers cautioned that their solution only works in certain conditions, namely if computers had not been rebooted since becoming infected and if victims applied the fix before WannaCry carried out its threat to lock their files permanently.

Europol said on Twitter that its European Cybercrime Centre had tested the team&#39;s new tool and said it was &quot;found to recover data in some circumstances&quot;.

The group includes Adrien Guinet, who works as a security expert, Matthieu Suiche, who is an internationally known hacker, and Benjamin Delpy, who helped out by night, in his spare time, outside his day job at the Banque de France.

&quot;We knew we must go fast because, as time passes, there is less chance to recover,&quot; Delpy said after a second sleepless night of work this week allowed him to release a workable way to decrypt WannaCry at 9.30&nbsp;am on Friday.

Delpy calls his free tool for decrypting infected computers without paying ransom &quot;wanakiwi&quot;.

Suiche published a blog with technical details summarising what the group of passing online acquaintances has built and is racing to share with technical staff at organisations infected by WannaCry.

Wanakiwi was quickly tested and shown to work on Windows 7 and older Windows versions XP and 2003, Suiche said, adding that he believed the hastily developed fix also works with Windows 2008 and Vista, meaning the entire universe of affected PCs.

&quot;(The method) should work with any operating system from XP to Win7,&quot; Suiche told Reuters, via direct message on Twitter.

Delpy added that so far, banking, energy and some government intelligence agencies from several European countries and India had contacted him regarding the fix.

The only workable solution

Guinet, a security researcher at Paris-based Quarks Lab, published the theoretical technique for decrypting WannaCry files late Wednesday and Thursday, which Delpy, also in Paris, figured out how to turn into a practical tool to salvage files.

Suiche, based in Dubai and one of the world&#39;s top independent security researchers, provided advice and testing to ensure the fix worked across all various versions of Windows.

His blog post links to a Delpy&#39;s &quot;wanakiwi&quot; decryption tool which is based on Guinet&#39;s original concept. His idea involves extracting the keys to WannaCry encryption codes using prime numbers rather than attempting to break the endless string of digits behind the malicious software&#39;s full encryption key.

&quot;This is not a perfect solution,&quot; Suiche said. &quot;But this is so far the only workable solution to help enterprises to recover their files if they have been infected and have no back-ups&quot; which allow users to restore data without paying black-mailers.

As of Wednesday, half of all internet addresses corrupted globally by WannaCry were located in China and Russia, with 30 and 20 per cent of infections, respectively, according to data supplied by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said.

Only 309 transactions worth around $94,000 appear to have been paid into WannaCry blackmail accounts by Friday, sevens days after the attack began.

That&#39;s just under one in 1,000 of the estimated victims.

This may reflect a variety of factors, security experts say, including scepticism that attackers will honor their promises or the possibility that organisations have back-up storage plans allowing them to recover their data without paying ransom.

(Reuters)

Researchers scattered across the globe collaborated to develop a workaround to unlock the encryption key for files hit in the global attack

French researchers said on Friday they had found a last-chance way for technicians to save Windows files encrypted by WannaCry, racing against a deadline as the ransomware threatens to start locking up victims' computers first infected a week ago. WannaCry, which started to sweep round the globe last Friday and has infected more than 300,000 computers in 150 nations, threatens to lock out victims who have not paid a sum of $300 to $600 within one week of infection. A loose-knit team of security researchers scattered across the globe said they had collaborated to develop a workaround to unlock the encryption key for files hit in the global attack, which several independent security researchers have confirmed. The researchers cautioned that their solution only works in certain conditions, namely if computers had not been rebooted since becoming infected and if victims applied the fix before WannaCry carried out its threat to lock their files permanently. Europol said on Twitter that its European Cybercrime Centre had tested the team's new tool and said it was "found to recover data in some circumstances". The group includes Adrien Guinet, who works as a security expert, Matthieu Suiche, who is an internationally known hacker, and Benjamin Delpy, who helped out by night, in his spare time, outside his day job at the Banque de France. "We knew we must go fast because, as time passes, there is less chance to recover," Delpy said after a second sleepless night of work this week allowed him to release a workable way to decrypt WannaCry at 9.30 am on Friday. Delpy calls his free tool for decrypting infected computers without paying ransom "wanakiwi". Suiche published a blog with technical details summarising what the group of passing online acquaintances has built and is racing to share with technical staff at organisations infected by WannaCry. Wanakiwi was quickly tested and shown to work on Windows 7 and older Windows versions XP and 2003, Suiche said, adding that he believed the hastily developed fix also works with Windows 2008 and Vista, meaning the entire universe of affected PCs. "(The method) should work with any operating system from XP to Win7," Suiche told Reuters, via direct message on Twitter. Delpy added that so far, banking, energy and some government intelligence agencies from several European countries and India had contacted him regarding the fix. The only workable solution Guinet, a security researcher at Paris-based Quarks Lab, published the theoretical technique for decrypting WannaCry files late Wednesday and Thursday, which Delpy, also in Paris, figured out how to turn into a practical tool to salvage files. Suiche, based in Dubai and one of the world's top independent security researchers, provided advice and testing to ensure the fix worked across all various versions of Windows. His blog post links to a Delpy's "wanakiwi" decryption tool which is based on Guinet's original concept. His idea involves extracting the keys to WannaCry encryption codes using prime numbers rather than attempting to break the endless string of digits behind the malicious software's full encryption key. "This is not a perfect solution," Suiche said. "But this is so far the only workable solution to help enterprises to recover their files if they have been infected and have no back-ups" which allow users to restore data without paying black-mailers. As of Wednesday, half of all internet addresses corrupted globally by WannaCry were located in China and Russia, with 30 and 20 per cent of infections, respectively, according to data supplied by threat intelligence firm Kryptos Logic. By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said. Only 309 transactions worth around $94,000 appear to have been paid into WannaCry blackmail accounts by Friday, sevens days after the attack began. That's just under one in 1,000 of the estimated victims. This may reflect a variety of factors, security experts say, including scepticism that attackers will honor their promises or the possibility that organisations have back-up storage plans allowing them to recover their data without paying ransom. (Reuters)

French researchers find way to unlock WannaCry without ransom

For Kris Hagerman, chief executive of UK-based cyber security firm Sophos Group, the past week could have been bad. The WannaCry &quot;ransomware&quot; attack hobbled some of its hospital customers in Britain&#39;s National Health Service, forcing them to turn away ambulances and cancel surgeries.

The company quickly removed a boast on its website that &ldquo;The NHS is totally protected with Sophos.&rdquo; In many industries, that sort of stumble would likely hit a company&#39;s reputation hard.

Yet on Monday, three days after the global malware attack was first detected, Sophos stock jumped more than 7 per cent to set a record high and climbed further on Wednesday after the company raised its financial forecasts.

As for most other cyber security firms, highly publicized cyber attacks are good for business, even though experts say such attacks underscore the industry&#39;s failings.

&quot;We are making good progress and are doing a good job,&quot; Hagerman said in an interview this week. &quot;People ask &#39;How come you haven&rsquo;t solved the cyber crime problem?&#39; and it&#39;s a little like saying &#39;You human beings have been around for hundreds of thousands of years, how come you haven&#39;t solved the crime problem?&#39;&quot;

Hagerman pointed out that his company only claimed to protect 60 per cent of NHS affiliates and that other factors contributed to the disaster at the hospitals.

&quot;They have their own budgets. They have their own approach to IT generally and IT security,&rdquo; Hagerman said of individual hospitals, which pick their own operating systems, patching cycles and network setups. Microsoft had issued a patch in March for the flaw WannaCry exploited in Windows operating systems.

Yet Hagerman acknowledged that Sophos did not update its basic antivirus software to block WannaCry until hours after it hit customers.

High stakes

Security experts say hospitals, where the stakes are especially high, represent a case study in how legacy industries need to up their cyber security game.

&quot;We&#39;ve tolerated a pretty poor level of effectiveness, because so far the consequences of failure have been acceptable,&quot; said Josh Corman, a cyber security industry veteran now working on related issues at the Atlantic Council and a member of a healthcare security task force established by the US&nbsp;Congress.

&quot;We are going to see failure measured in loss of life and a hit to GDP, and people will be very surprised.&quot;

Some long-lived medical devices have more than a thousand vulnerabilities, Corman said, and perhaps 85 per cent of US&nbsp;medical institutions have no staff qualified for basic cyber security tasks such as patching software, monitoring threat advisories and separating networks from one another.

Increasingly serious cyber security problems are partly an inevitable consequence of the growing complexity of digital technology.

But there are other causes too, including a lack of accountability that stems from the wide range of technology handlers: computer software vendors, antivirus suppliers, in-house professionals, consultants and various regulators.

Ultimately, Corman said, hospitals need to hire solid cyber security people instead of another nurse or two.

Good for business

&quot;What&rsquo;s needed is punishment of the negligent,&quot; said Ross Anderson, a University of Cambridge pioneer in studying the economics of information security, referring to the hospitals that did not stop WannaCry.

&quot;This is not about technology. This is about people fouling up in ways people would get a pink slip for&rdquo; in less-insulated environments, he said, meaning they would lose their jobs.

For now, though, there are few signs of any revamp in large institutions&#39; approach to cyber security - and little incentive for contractors in the cyber security industry to change.

Sophos was not the only company whose stock rose on Monday, as the global scale of WannaCry became apparent. Shares of US-based FireEye&nbsp;and Qualys&nbsp;both rose more than 5 per cent.

But Sophos stood out, aided by higher expectations for a product the company introduced last year to fend off ransomware - so called because the authors of the malware demand a &#39;ransom&#39; to restore a user&#39;s infected computer - which worked at the hospitals that had installed it.

&quot;It&#39;s good news for our business,&quot; one Sophos employee, who asked not to be named, told Reuters this week. &quot;We were so inundated with people calling us.&quot;

(Reuters)

Stocks of cyber security firms rise as the global scale of WannaCry becomes apparent

For Kris Hagerman, chief executive of UK-based cyber security firm Sophos Group, the past week could have been bad. The WannaCry "ransomware" attack hobbled some of its hospital customers in Britain's National Health Service, forcing them to turn away ambulances and cancel surgeries. The company quickly removed a boast on its website that “The NHS is totally protected with Sophos.” In many industries, that sort of stumble would likely hit a company's reputation hard. Yet on Monday, three days after the global malware attack was first detected, Sophos stock jumped more than 7 per cent to set a record high and climbed further on Wednesday after the company raised its financial forecasts. As for most other cyber security firms, highly publicized cyber attacks are good for business, even though experts say such attacks underscore the industry's failings. "We are making good progress and are doing a good job," Hagerman said in an interview this week. "People ask 'How come you haven’t solved the cyber crime problem?' and it's a little like saying 'You human beings have been around for hundreds of thousands of years, how come you haven't solved the crime problem?'" Hagerman pointed out that his company only claimed to protect 60 per cent of NHS affiliates and that other factors contributed to the disaster at the hospitals. "They have their own budgets. They have their own approach to IT generally and IT security,” Hagerman said of individual hospitals, which pick their own operating systems, patching cycles and network setups. Microsoft had issued a patch in March for the flaw WannaCry exploited in Windows operating systems. Yet Hagerman acknowledged that Sophos did not update its basic antivirus software to block WannaCry until hours after it hit customers. High stakes Security experts say hospitals, where the stakes are especially high, represent a case study in how legacy industries need to up their cyber security game. "We've tolerated a pretty poor level of effectiveness, because so far the consequences of failure have been acceptable," said Josh Corman, a cyber security industry veteran now working on related issues at the Atlantic Council and a member of a healthcare security task force established by the US Congress. "We are going to see failure measured in loss of life and a hit to GDP, and people will be very surprised." Some long-lived medical devices have more than a thousand vulnerabilities, Corman said, and perhaps 85 per cent of US medical institutions have no staff qualified for basic cyber security tasks such as patching software, monitoring threat advisories and separating networks from one another. Increasingly serious cyber security problems are partly an inevitable consequence of the growing complexity of digital technology. But there are other causes too, including a lack of accountability that stems from the wide range of technology handlers: computer software vendors, antivirus suppliers, in-house professionals, consultants and various regulators. Ultimately, Corman said, hospitals need to hire solid cyber security people instead of another nurse or two. Good for business "What’s needed is punishment of the negligent," said Ross Anderson, a University of Cambridge pioneer in studying the economics of information security, referring to the hospitals that did not stop WannaCry. "This is not about technology. This is about people fouling up in ways people would get a pink slip for” in less-insulated environments, he said, meaning they would lose their jobs. For now, though, there are few signs of any revamp in large institutions' approach to cyber security - and little incentive for contractors in the cyber security industry to change. Sophos was not the only company whose stock rose on Monday, as the global scale of WannaCry became apparent. Shares of US-based FireEye and Qualys both rose more than 5 per cent. But Sophos stood out, aided by higher expectations for a product the company introduced last year to fend off ransomware - so called because the authors of the malware demand a 'ransom' to restore a user's infected computer - which worked at the hospitals that had installed it. "It's good news for our business," one Sophos employee, who asked not to be named, told Reuters this week. "We were so inundated with people calling us." (Reuters)

WannaCry ransomware attack good business for cyber security firms

The WannaCry ransomware attack compromised the systems of Russian banks in some isolated cases, the Russian central bank said on Friday in the first official acknowledgement by Moscow that the virus had an impact on the country&#39;s banking system.

In a statement, the central bank said the consequences of the hacking attack - which it did not detail - had been dealt with quickly. The central bank had previously said Russian banks were targeted in the global cyber extortion campaign late last week, but that the attack had been unsuccessful.

On Friday, the central bank said it had sent recommendations to Russian banks to update their Windows software in April, before the WannaCry attack on May 12.

After the attack, the central bank reissued its recommendations to Russian banks, it said, adding that it would start publishing statements on its website about cyber attacks it had caught as well as steps taken to reinforce IT security.

&quot;As a result of the malicious WannaCry software being spread, we recorded isolated cases of credit organisations&#39; resources being compromised,&quot; the central bank said.

The WannaCry attack was global in scale, affecting computer systems in dozens of countries. But Russia was among the hardest hit, with the attack exposing security flaws in some of its largest institutions.

There has so far been only scant evidence that banks&#39; systems outside Russia have been compromised. There have been reports of WannaCry ransom demands appearing on ATM screens in Asia, but these have not been verified by Reuters.

Russia&#39;s largest bank Sberbank said late last week it had been attacked by a virus but that its systems were not infected. It declined to comment when contacted by Reuters on Friday about the central bank statement.

Two security researchers who investigated the attack told Reuters that rival lender VTB was attacked, but they said it was unclear if any damage to the bank&#39;s system resulted, or what the extent of any damage had been.

The two researchers said they did not want to be identified discussing confidential security matters.&nbsp;VTB did not comment on whether it was attacked but said its systems and of those of its VTB24 retail banking business were operating normally.

&quot;The weaknesses exploited by the virus which attacked computers all over the world and paralysed the work of many large companies do not exist in the banking group&#39;s systems,&quot; it said in response to a request for comment.

Sergey Golovanov, principal security researcher at Russia&#39;s Kaspersky Lab, said &quot;a couple&quot; of Russian banks had encountered the WannaCry malware. He did not name them.

&quot;In most cases the infections hit either PCs belonging to ordinary employees or some non-critical systems,&quot; he said.

&quot;Embedded systems are very often running on old versions of operating systems and they could easily become a target of malware like WannaCry.&quot;

Russia&#39;s relationship to cyber crime is under intense scrutiny after US&nbsp;intelligence officials alleged that Russian hackers had tried to help Republican Donald Trump win the U.S. presidency by hacking Democratic Party servers.

The Kremlin has repeatedly denied the allegation.

Bombarded by allegations of state-sponsored hacking, Moscow is now keen to show Russia too is a frequent victim of cyber crime and that it is working hard to combat it.

(Reuters) 
&nbsp;

The central bank had previously said Russian banks were targeted in the global cyber extortion campaign late last week

The WannaCry ransomware attack compromised the systems of Russian banks in some isolated cases, the Russian central bank said on Friday in the first official acknowledgement by Moscow that the virus had an impact on the country's banking system. In a statement, the central bank said the consequences of the hacking attack - which it did not detail - had been dealt with quickly. The central bank had previously said Russian banks were targeted in the global cyber extortion campaign late last week, but that the attack had been unsuccessful. On Friday, the central bank said it had sent recommendations to Russian banks to update their Windows software in April, before the WannaCry attack on May 12. After the attack, the central bank reissued its recommendations to Russian banks, it said, adding that it would start publishing statements on its website about cyber attacks it had caught as well as steps taken to reinforce IT security. "As a result of the malicious WannaCry software being spread, we recorded isolated cases of credit organisations' resources being compromised," the central bank said. The WannaCry attack was global in scale, affecting computer systems in dozens of countries. But Russia was among the hardest hit, with the attack exposing security flaws in some of its largest institutions. There has so far been only scant evidence that banks' systems outside Russia have been compromised. There have been reports of WannaCry ransom demands appearing on ATM screens in Asia, but these have not been verified by Reuters. Russia's largest bank Sberbank said late last week it had been attacked by a virus but that its systems were not infected. It declined to comment when contacted by Reuters on Friday about the central bank statement. Two security researchers who investigated the attack told Reuters that rival lender VTB was attacked, but they said it was unclear if any damage to the bank's system resulted, or what the extent of any damage had been. The two researchers said they did not want to be identified discussing confidential security matters. VTB did not comment on whether it was attacked but said its systems and of those of its VTB24 retail banking business were operating normally. "The weaknesses exploited by the virus which attacked computers all over the world and paralysed the work of many large companies do not exist in the banking group's systems," it said in response to a request for comment. Sergey Golovanov, principal security researcher at Russia's Kaspersky Lab, said "a couple" of Russian banks had encountered the WannaCry malware. He did not name them. "In most cases the infections hit either PCs belonging to ordinary employees or some non-critical systems," he said. "Embedded systems are very often running on old versions of operating systems and they could easily become a target of malware like WannaCry." Russia's relationship to cyber crime is under intense scrutiny after US intelligence officials alleged that Russian hackers had tried to help Republican Donald Trump win the U.S. presidency by hacking Democratic Party servers. The Kremlin has repeatedly denied the allegation. Bombarded by allegations of state-sponsored hacking, Moscow is now keen to show Russia too is a frequent victim of cyber crime and that it is working hard to combat it. (Reuters)

WannaCry cyber attack compromised some banks: Russian central bank

A pleasant Saturday morning turned worrisome for thousands of corporates as well as government webpage developers when the news of cyber ransom attack spread. Individual users of internet, including me, were still anticipating that nothing will happen to us. It was still believed that the attackers were targeting the west and that too big data houses. We were all proved wrong within no time.

I first noticed the alert sign with a&nbsp;cyber attack in a Facebook post by Dr.Subhajit Basu, Associate Professor of Information Technology Law in School of Law, University of Leeds, who is also my senior in law college in the University of Calcutta, which mentioned about shutting down of the NHS websites due to some virus attacks.

He wrote &ldquo;There has been a huge &#39;CyberAttack&#39;&nbsp;on NHS. NHS services across England have been hit by IT failure, it seems to have happened because of large-scale cyber attack. Trusts and hospitals in London, Blackburn, Nottingham, Cumbria and Hertfordshire have been affected. It looks like a massive ransomware virus that has infected all computers on the NHS.&rdquo; It must be noticed that this post was made on 12th May, 2017, and not many&nbsp;felt the graveness of this attack until 13th morning, except those who were working in the cyber security sectors.

In no time, we got to see that not the nations, but continents were&nbsp;affected by this virus and in Asia, India was in the top of the worst hit list.

What is ransom attack and how does it affect us? 

By now, almost all of us have come to know that this malware known as Wannacry ransom attack is actually a virus which is spreading through &ldquo;loaded hyperlink&rdquo; which can be sent through mail, webpage etc. One popular explanation has been&nbsp;that this loaded hyperlink is sent through mails from senders who&nbsp;the victim&nbsp;may not suspect as a malicious sender; further, once opened, it may first decrypt only to encrypt the files which may not be encrypted otherwise.

Plainly, Wannacry virus is another form of privacy infringing mechanism which unauthorisedly accesses the data. The uniqueness about this is, it does not stop with encrypting the files against the wish of the data owner; the attackers play the hi-tech criminal part by demanding a ransom that may be in the form of cryptocurrency Bitcoin.&nbsp;

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>The uniqueness about this is, it does not stop with encrypting the files against the wish of the data owner; the attackers play the hi-tech criminal part by demanding a ransom that may be in the form of cryptocurrency Bitcoin</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=The uniqueness about this is, it does not stop with encrypting the files against the wish of the data owner; the attackers play the hi-tech criminal part by demanding a ransom that may be in the form of cryptocurrency Bitcoin" target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

&nbsp;

What is the form of attack? One may ask what sort of offence it may form? Attack on the computer? Attack on the computer networks? Damaging the files? Unauthorised access to the computer? Or something graver? In my opinion it indeed is a graver offence beyond simple attack on the computer. This may be explained as below:

In a way, it has proved a bunch of irresponsible hackers and hacking trainers&rsquo; thought &ldquo;hacking is fun&rdquo; at the cost of millions of people. It is like illegally breaking into&nbsp;a house and locking one&rsquo;s valuables only to extort. It is nothing but hacxtortion: hacking and extortion.

Who should be careful about it and why? 

Not to forget that we have just started an era of demonetisation where our physical lockers, purses carry less currency and virtual purses &nbsp;carry more &nbsp;money. Individuals engaged in digital transaction must, therefore, be extremely careful to protect their data. Apart from ordinary individuals, I see several other categories of people and companies who may be possible targets of wannacry racket and this includes writers, academicians, scientists and also film production companies.&nbsp;All these&nbsp;sectors may not only earn their reputation, but also livelihood by way of intellectual properties, which is generally stored in the personal computers.

The other sector which must be extremely cautious to protect their data and computer is obviously the &quot;rights defenders&quot;, i.e., the lawyers and the courts as they may be seen as custodians of private data of many individuals, including the accused as well as the victims. I say this because already health sector may have been affected, resulting in partially suspending services to the patients.&nbsp;

Further, this has to be noted again that individuals not only store important data related to banking in their devices, we, especially women may also store something which we need to worry about: our private pictures/images. Professor K.Jaishankar and I have done extensive research (Cyber Crimes Against Women In India,&nbsp;Sage: 2016) on sextortion and revenge porn along with other sorts of cyber offences targeting women.

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>Imagine, if these women who are superstars suffer from&nbsp;such privacy infringement what happens to ordinary women who are being targeted by ransom attackers</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=Imagine, if these women who are superstars suffer from?such privacy infringement what happens to ordinary women who are being targeted by ransom attackers" target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

&nbsp;

But it must be noted that such offences, including sextortion may have been majorly interpersonal victimisation. In most cases, these may have been related to revenge porn or online grooming &nbsp;by unknown &ldquo;frenemies&rdquo; for the purpose of unethical profit making. It is well-known that&nbsp;nude or semi nude images of women get sold to adult entertainment sites.

Some of us may remember the biggest ever privacy infringement&nbsp;on&nbsp;film stars happened earlier this year when some hackers had stolen private pictures of film stars and posted it publicly. Imagine, if these women who are superstars suffer from&nbsp;such privacy infringement what happens to ordinary women who are being targeted by ransom attackers. &nbsp;

Possible solutions&nbsp;&nbsp;

By now, several write-ups have been published to recommend how to save your computers and data from the ransom attack and almost every suggestions indicate that payment of ransom is no answer to recover the&nbsp;encrypted data. Speaking from legal perspectives, we must understand that our Information Technology Act, 2000 (amended in 2008) does provide some solutions if not fully; the attack may be regulated under S.43 (penalty, compensation for &nbsp;damage to computer, computer system) along with S.65 (tampering with computer source document) and 66 (computer related offences), along with provisions from Indian Penal Code, especially relating to extortion. Not to forget that our Information Technology Act has extra-territorial jurisdiction which may need to be executed in prosecuting cases.

However, there is definitely a loophole as there lacks a ratified treaty for cooperation in such cases.&nbsp;Moreover,&nbsp;our criminal justice administration, especially the police needs special training to nab the criminals, particularly when individuals are attacked.

But still then, we have come across a long way since the spreading of &ldquo;I love you&rdquo; virus which almost totally handicapped a nascent cyber-aware nation. A little awareness may make us more immune towards such attacks.

&nbsp;

The ransom attack is like illegally entering a house and locking one?s valuables only to extort

A pleasant Saturday morning turned worrisome for thousands of corporates as well as government webpage developers when the news of cyber ransom attack spread. Individual users of internet, including me, were still anticipating that nothing will happen to us. It was still believed that the attackers were targeting the west and that too big data houses. We were all proved wrong within no time. I first noticed the alert sign with a cyber attack in a Facebook post by Dr.Subhajit Basu, Associate Professor of Information Technology Law in School of Law, University of Leeds, who is also my senior in law college in the University of Calcutta, which mentioned about shutting down of the NHS websites due to some virus attacks. He wrote “There has been a huge 'CyberAttack' on NHS. NHS services across England have been hit by IT failure, it seems to have happened because of large-scale cyber attack. Trusts and hospitals in London, Blackburn, Nottingham, Cumbria and Hertfordshire have been affected. It looks like a massive ransomware virus that has infected all computers on the NHS.” It must be noticed that this post was made on 12th May, 2017, and not many felt the graveness of this attack until 13th morning, except those who were working in the cyber security sectors. In no time, we got to see that not the nations, but continents were affected by this virus and in Asia, India was in the top of the worst hit list. What is ransom attack and how does it affect us? By now, almost all of us have come to know that this malware known as Wannacry ransom attack is actually a virus which is spreading through “loaded hyperlink” which can be sent through mail, webpage etc. One popular explanation has been that this loaded hyperlink is sent through mails from senders who the victim may not suspect as a malicious sender; further, once opened, it may first decrypt only to encrypt the files which may not be encrypted otherwise. Plainly, Wannacry virus is another form of privacy infringing mechanism which unauthorisedly accesses the data. The uniqueness about this is, it does not stop with encrypting the files against the wish of the data owner; the attackers play the hi-tech criminal part by demanding a ransom that may be in the form of cryptocurrency Bitcoin. The uniqueness about this is, it does not stop with encrypting the files against the wish of the data owner; the attackers play the hi-tech criminal part by demanding a ransom that may be in the form of cryptocurrency Bitcoin × What is the form of attack? One may ask what sort of offence it may form? Attack on the computer? Attack on the computer networks? Damaging the files? Unauthorised access to the computer? Or something graver? In my opinion it indeed is a graver offence beyond simple attack on the computer. This may be explained as below: In a way, it has proved a bunch of irresponsible hackers and hacking trainers’ thought “hacking is fun” at the cost of millions of people. It is like illegally breaking into a house and locking one’s valuables only to extort. It is nothing but hacxtortion: hacking and extortion. Who should be careful about it and why? Not to forget that we have just started an era of demonetisation where our physical lockers, purses carry less currency and virtual purses carry more money. Individuals engaged in digital transaction must, therefore, be extremely careful to protect their data. Apart from ordinary individuals, I see several other categories of people and companies who may be possible targets of wannacry racket and this includes writers, academicians, scientists and also film production companies. All these sectors may not only earn their reputation, but also livelihood by way of intellectual properties, which is generally stored in the personal computers. The other sector which must be extremely cautious to protect their data and computer is obviously the "rights defenders", i.e., the lawyers and the courts as they may be seen as custodians of private data of many individuals, including the accused as well as the victims. I say this because already health sector may have been affected, resulting in partially suspending services to the patients. Further, this has to be noted again that individuals not only store important data related to banking in their devices, we, especially women may also store something which we need to worry about: our private pictures/images. Professor K.Jaishankar and I have done extensive research (Cyber Crimes Against Women In India, Sage: 2016) on sextortion and revenge porn along with other sorts of cyber offences targeting women. Imagine, if these women who are superstars suffer from such privacy infringement what happens to ordinary women who are being targeted by ransom attackers × But it must be noted that such offences, including sextortion may have been majorly interpersonal victimisation. In most cases, these may have been related to revenge porn or online grooming by unknown “frenemies” for the purpose of unethical profit making. It is well-known that nude or semi nude images of women get sold to adult entertainment sites. Some of us may remember the biggest ever privacy infringement on film stars happened earlier this year when some hackers had stolen private pictures of film stars and posted it publicly. Imagine, if these women who are superstars suffer from such privacy infringement what happens to ordinary women who are being targeted by ransom attackers. Possible solutions By now, several write-ups have been published to recommend how to save your computers and data from the ransom attack and almost every suggestions indicate that payment of ransom is no answer to recover the encrypted data. Speaking from legal perspectives, we must understand that our Information Technology Act, 2000 (amended in 2008) does provide some solutions if not fully; the attack may be regulated under S.43 (penalty, compensation for damage to computer, computer system) along with S.65 (tampering with computer source document) and 66 (computer related offences), along with provisions from Indian Penal Code, especially relating to extortion. Not to forget that our Information Technology Act has extra-territorial jurisdiction which may need to be executed in prosecuting cases. However, there is definitely a loophole as there lacks a ratified treaty for cooperation in such cases. Moreover, our criminal justice administration, especially the police needs special training to nab the criminals, particularly when individuals are attacked. But still then, we have come across a long way since the spreading of “I love you” virus which almost totally handicapped a nascent cyber-aware nation. A little awareness may make us more immune towards such attacks.

The ransom attack that may make the women cry

China has urged Windows users to protect themselves against a new ransomware virus similar to the WannaCry bug that wreaked havoc worldwide last week.

&quot;UIWIX&quot; encrypts and renames files through a bug in the Windows operating system, China&#39;s National Computer Virus Emergency Response Center (CVERC) warned in a public announcement Wednesday, telling users to install the latest Microsoft update.

The warning comes on the heels of the &quot;WannaCry&quot; cyberattack, which has hit hundreds of thousands of computers worldwide.

While no UIWIX infections have yet been detected in China, the virus has spread in other countries and prompted a security alert last week from the Danish cybersecurity company Heimdal Security.

&quot;UIWIX ransomware is picking up where the first WannaCry wave left off, without a kill switch domain and the same self-replicating abilities that enable it to spread fast,&quot; the firm said in a statement.

Heimdal cautioned that the new bug could be more powerful than WannaCry due to the absence of a kill switch domain that could contain the virus&#39;s distribution.

But other analysts have noted that UIWIX appears to be spreading at a much slower pace.

Global cybersecurity firm Proofpoint warned on Wednesday about another large-scale, stealthy cyberattack linked to WannaCry called Adylkuzz.

The extent of Wannacry&#39;s impact in China remains unclear.

On Sunday, Qihoo 360, one of China&#39;s leading suppliers of anti-virus software, said more than 29,000 institutions ranging from government offices to ATMs and hospitals had been &quot;infected&quot; by Wannacry, singling out universities as particularly hard-hit.

But the Education Ministry&#39;s China Education and Research Network denied that there had been widespread damage to computer systems, saying only 66 out of 1,600 Chinese universities were affected.

Sarah Larson, a politics and cybersecurity researcher at the University of New South Wales, told AFP that China&#39;s preemptive alert about UIWIX may indicate that WannaCry sent the government &quot;reeling.&quot;

Larson said China is particularly vulnerable to malicious code because the majority of the country&#39;s computer users are reliant on pirated software.

&quot;Until now the government has done little to encourage the use of legitimate software,&quot; she said.

&quot;This reluctance is largely caused by a type of cyber sovereignty directed at the dominance of US tech companies like Microsoft.&quot;

Severine Arsene, an Internet expert at the French Centre for Research on Contemporary China, said the announcement, which noted the virus was &quot;detected abroad,&quot; is in line with China&#39;s current rhetoric around cybersecurity.

&quot;China has long claimed that they are a major victim of cyber attacks every year,&quot; Arsene told AFP, &quot;whereas they are essentially portrayed as a source of cyberattacks by foreign media.&quot;

The warning is intended &quot;to publicly show that they are taking responsibility to help maintain security and stability online&quot;.

The government will implement on June 1 a controversial cybersecurity bill tightening restrictions on online freedom of speech and imposing new rules on online service providers.

Fifty-four international trade groups signed a letter Monday calling on China to reconsider the law, arguing that it would create significant obstacles for foreign businesses.

(AFP)

The warning comes on the heels of the 'WannaCry' cyberattack, which has hit hundreds of thousands of computers worldwide

China has urged Windows users to protect themselves against a new ransomware virus similar to the WannaCry bug that wreaked havoc worldwide last week. "UIWIX" encrypts and renames files through a bug in the Windows operating system, China's National Computer Virus Emergency Response Center (CVERC) warned in a public announcement Wednesday, telling users to install the latest Microsoft update. The warning comes on the heels of the "WannaCry" cyberattack, which has hit hundreds of thousands of computers worldwide. While no UIWIX infections have yet been detected in China, the virus has spread in other countries and prompted a security alert last week from the Danish cybersecurity company Heimdal Security. "UIWIX ransomware is picking up where the first WannaCry wave left off, without a kill switch domain and the same self-replicating abilities that enable it to spread fast," the firm said in a statement. Heimdal cautioned that the new bug could be more powerful than WannaCry due to the absence of a kill switch domain that could contain the virus's distribution. But other analysts have noted that UIWIX appears to be spreading at a much slower pace. Global cybersecurity firm Proofpoint warned on Wednesday about another large-scale, stealthy cyberattack linked to WannaCry called Adylkuzz. The extent of Wannacry's impact in China remains unclear. On Sunday, Qihoo 360, one of China's leading suppliers of anti-virus software, said more than 29,000 institutions ranging from government offices to ATMs and hospitals had been "infected" by Wannacry, singling out universities as particularly hard-hit. But the Education Ministry's China Education and Research Network denied that there had been widespread damage to computer systems, saying only 66 out of 1,600 Chinese universities were affected. Sarah Larson, a politics and cybersecurity researcher at the University of New South Wales, told AFP that China's preemptive alert about UIWIX may indicate that WannaCry sent the government "reeling." Larson said China is particularly vulnerable to malicious code because the majority of the country's computer users are reliant on pirated software. "Until now the government has done little to encourage the use of legitimate software," she said. "This reluctance is largely caused by a type of cyber sovereignty directed at the dominance of US tech companies like Microsoft." Severine Arsene, an Internet expert at the French Centre for Research on Contemporary China, said the announcement, which noted the virus was "detected abroad," is in line with China's current rhetoric around cybersecurity. "China has long claimed that they are a major victim of cyber attacks every year," Arsene told AFP, "whereas they are essentially portrayed as a source of cyberattacks by foreign media." The warning is intended "to publicly show that they are taking responsibility to help maintain security and stability online". The government will implement on June 1 a controversial cybersecurity bill tightening restrictions on online freedom of speech and imposing new rules on online service providers. Fifty-four international trade groups signed a letter Monday calling on China to reconsider the law, arguing that it would create significant obstacles for foreign businesses. (AFP)

China warns Windows users of fresh ransomware virus attack

Major cyber security firms Symantec&nbsp;and Kaspersky said on Monday they were looking into clues that may connect the global &quot;ransomware&quot; attack known as WannaCry with programs previously attributed to North Korea.

The two companies said some code in an earlier version of the WannaCry ransomware, which has encrypted data on hundreds of thousands of computers since Friday, had also appeared in programs used by the Lazarus Group, which researchers from many companies said is run by North Korea.&nbsp;

The ransomware demanded users pay money to regain control of their machines,

The North Korean mission to the United Nations was not immediately available for comment.

(Reuters)

The ransomware which has encrypted data on hundreds of thousands of computers demands users pay money to regain control of their machines

Major cyber security firms Symantec and Kaspersky said on Monday they were looking into clues that may connect the global "ransomware" attack known as WannaCry with programs previously attributed to North Korea. The two companies said some code in an earlier version of the WannaCry ransomware, which has encrypted data on hundreds of thousands of computers since Friday, had also appeared in programs used by the Lazarus Group, which researchers from many companies said is run by North Korea. The ransomware demanded users pay money to regain control of their machines, The North Korean mission to the United Nations was not immediately available for comment. (Reuters)

Possible North Korea tie to the WannaCry ransomware attack

Chinese local authorities from traffic police to industry regulators were hobbled on Monday by a massive global ransomware attack, but the spread of the WannaCry worm in the country appeared less aggressive than initially feared. &nbsp;(<a href="http://http://www.wionews.com/science-tech/wannacry-what-is-ransomware-and-how-to-protect-yourself-from-it-15608">Also Read: WannaCry: What is ransomware and how to protect yourself from it</a>)

Dozens of local Chinese authorities said they had suspended some of their services due to the attack that has disrupted operations at car factories, hospitals, shops and schools around the world.

However, officials and security firms said the spread was starting to slow in the country, which has the world&#39;s largest number of Internet users.

&quot;The growth rate of infected institutions on Monday has slowed significantly compared to the previous two days,&quot; said Chinese Internet security company Qihoo 360.

&quot;Previous concerns of a wide-scale infection of domestic institutions did not eventuate.&quot;

Qihoo has previously said the attack had infected close to 30,000 organizations by Saturday evening. Of that, over 4,000 were educational institutions.

An official from Cybersecurity Administration China (CAC) told local media on Monday that while the ransomware was still spreading and had affected industry and government computer systems, the spread was slowing.

China remained a major source of attack from infected computers, at least during the Asian day, said Michael Gazeley, managing director of Network Box, a Hong Kong-based cybersecurity firm.

At about noon (0400 GMT), nearly 47 per cent of attacks on Network Box&#39;s clients came from China. This would change, Gazeley said, as Europe and US computers are turned on, but it indicated the scale of the problem there.

Chinese government bodies from transport, social security, industry watchdogs and immigration said they had suspended services ranging from processing applications to traffic crime enforcement.

It&#39;s not clear whether the services were suspended due to attacks or for emergency patching to prevent infection. Even then, adding a patch was no simple task, experts said.

&quot;If a system supports some kind critical processes those systems typically are very hard to patch... We don&#39;t have a precedent from something of this scale (in China),&quot; said Marin Ivezic, a cybersecurity expert at PwC in Hong Kong.

Affected bodies included a social security department in the city of Changsha, the exit-entry bureau in Dalian, a housing fund in Zhuhai and an industry watchdog in Xuzhou.

The ransomware, which has locked up over 200,000 computers in more than 150 countries, has been mainly spread by e-mail, and in China has hit schools and colleges, energy giant PetroChina&#39;s &nbsp;payment systems and local government.

Security experts say most infected computers appear to be systems running out-of-date operating systems, or machines that are hard to patch without affecting crucial operations in areas like healthcare or manufacturing.

Beijing has said previously it is a victim of hacking, although the United States has accused it of cyber attacks on US government computer systems.

China is also set to implement a tougher new cyber security law from June 1, designed to strengthen critical infrastructure, even as many global tech firms and lobbies say that its cyber rules skew the playing field against foreign firms.

(Reuters)

China: Cyber attack hits government, schools, but spread slows

Chinese local authorities from traffic police to industry regulators were hobbled on Monday by a massive global ransomware attack, but the spread of the WannaCry worm in the country appeared less aggressive than initially feared. (Also Read: WannaCry: What is ransomware and how to protect yourself from it) Dozens of local Chinese authorities said they had suspended some of their services due to the attack that has disrupted operations at car factories, hospitals, shops and schools around the world. However, officials and security firms said the spread was starting to slow in the country, which has the world's largest number of Internet users. "The growth rate of infected institutions on Monday has slowed significantly compared to the previous two days," said Chinese Internet security company Qihoo 360. "Previous concerns of a wide-scale infection of domestic institutions did not eventuate." Qihoo has previously said the attack had infected close to 30,000 organizations by Saturday evening. Of that, over 4,000 were educational institutions. An official from Cybersecurity Administration China (CAC) told local media on Monday that while the ransomware was still spreading and had affected industry and government computer systems, the spread was slowing. China remained a major source of attack from infected computers, at least during the Asian day, said Michael Gazeley, managing director of Network Box, a Hong Kong-based cybersecurity firm. At about noon (0400 GMT), nearly 47 per cent of attacks on Network Box's clients came from China. This would change, Gazeley said, as Europe and US computers are turned on, but it indicated the scale of the problem there. Chinese government bodies from transport, social security, industry watchdogs and immigration said they had suspended services ranging from processing applications to traffic crime enforcement. It's not clear whether the services were suspended due to attacks or for emergency patching to prevent infection. Even then, adding a patch was no simple task, experts said. "If a system supports some kind critical processes those systems typically are very hard to patch... We don't have a precedent from something of this scale (in China)," said Marin Ivezic, a cybersecurity expert at PwC in Hong Kong. Affected bodies included a social security department in the city of Changsha, the exit-entry bureau in Dalian, a housing fund in Zhuhai and an industry watchdog in Xuzhou. The ransomware, which has locked up over 200,000 computers in more than 150 countries, has been mainly spread by e-mail, and in China has hit schools and colleges, energy giant PetroChina's payment systems and local government. Security experts say most infected computers appear to be systems running out-of-date operating systems, or machines that are hard to patch without affecting crucial operations in areas like healthcare or manufacturing. Beijing has said previously it is a victim of hacking, although the United States has accused it of cyber attacks on US government computer systems. China is also set to implement a tougher new cyber security law from June 1, designed to strengthen critical infrastructure, even as many global tech firms and lobbies say that its cyber rules skew the playing field against foreign firms. (Reuters)

Three days after &#39;ransomware&#39; hit computers across the world, several computers in West Bengal&#39;s power distribution company offices were attacked by&nbsp;&#39;ransomware&#39;.

Officials from West Bengal State Electricity Distribution Company (WBSEDCL) confirmed the development and said it has been detected at four offices in West Midnapore district affecting computers in four blocks of Belda, Datan, Narayngarh and Keshiyari.

Federal minister Ravi Shankar Prasad told reporters that there was no serious impact on India, with only isolated incidents in parts of Kerala and Andhra Pradesh states, and the government was monitoring the situation.

However, West Bengal power minister Sovandev Chattopadhyay told Reuters that several billing centres of the state&#39;s Electricity Distribution Company Ltd (WBSEDCL) had been infected by the ransomware worm.

<a href="http://www.wionews.com/science-tech/wannacry-what-is-ransomware-and-how-to-protect-yourself-from-it-15608">Also Read:&nbsp;WannaCry: What is ransomware and how to protect yourself from it</a>

The &#39;WannaCry&#39; ransomware is also suspected to have struck Kerala&#39;s Wayanad panchayat office. The authorities claim that the files could not be opened and there is a message demanding $300 dollars be put in the account within three days.

Aruna Sundararajan, secretary of India&#39;s Ministry of Electronics and Information Technology, told Reuters the government was constantly monitoring the situation and that a few stand-alone computers of a police department were &quot;back in action&quot; after being infected over the weekend.

India&#39;s National Informatics Centre, which builds and manages almost all government websites, and the Centre for Development of Advanced Computing, a premier research institute that has built supercomputers, have actively installed patches to immunise their Windows systems, Sundararajan added.

India&#39;s cyber security agency have alerted Internet users against damaging activities of &#39;WannaCry&#39; which critically infects workstations and locks them through remote access. A hacker sitting in a different country can easily operate on a string of computers, infecting it and easily disabling it.

In India, &#39;ransomware&#39; is made worse because many computers might still be on Windows XP, for which Microsoft had not issued security updates for some time. However, after the cyber attack, Microsoft issued a security patch to Windows XP to fix the security vulnerability as computers worldwide were affected by the virus.

Meanwhile, in Gujarat, the state government is now upgrading its computer systems with anti-virus software and updating the Microsoft OS as well.

The ransomware virus had struck Britain&#39;s national health service(NHS) on Friday evening shutting down computer services in at at least 16 hospitals initially, severely disrupting emergency services which had to be suspended.&nbsp;

<a href="http://www.wionews.com/science-tech/infographic-how-big-a-problem-is-ransomware-15613">Also Read:&nbsp;Infographic: How big a problem is </a><a href="http://www.wionews.com/science-tech/infographic-how-big-a-problem-is-ransomware-15613">ransomware</a><a href="http://www.wionews.com/science-tech/infographic-how-big-a-problem-is-ransomware-15613">?</a>

(WION with Agency&nbsp;inputs)

India's cyber security agency have alerted Internet users against damaging activities of 'WannaCry'

Three days after 'ransomware' hit computers across the world, several computers in West Bengal's power distribution company offices were attacked by 'ransomware'. Officials from West Bengal State Electricity Distribution Company (WBSEDCL) confirmed the development and said it has been detected at four offices in West Midnapore district affecting computers in four blocks of Belda, Datan, Narayngarh and Keshiyari. Federal minister Ravi Shankar Prasad told reporters that there was no serious impact on India, with only isolated incidents in parts of Kerala and Andhra Pradesh states, and the government was monitoring the situation. However, West Bengal power minister Sovandev Chattopadhyay told Reuters that several billing centres of the state's Electricity Distribution Company Ltd (WBSEDCL) had been infected by the ransomware worm. Also Read: WannaCry: What is ransomware and how to protect yourself from it The 'WannaCry' ransomware is also suspected to have struck Kerala's Wayanad panchayat office. The authorities claim that the files could not be opened and there is a message demanding $300 dollars be put in the account within three days. Aruna Sundararajan, secretary of India's Ministry of Electronics and Information Technology, told Reuters the government was constantly monitoring the situation and that a few stand-alone computers of a police department were "back in action" after being infected over the weekend. India's National Informatics Centre, which builds and manages almost all government websites, and the Centre for Development of Advanced Computing, a premier research institute that has built supercomputers, have actively installed patches to immunise their Windows systems, Sundararajan added. India's cyber security agency have alerted Internet users against damaging activities of 'WannaCry' which critically infects workstations and locks them through remote access. A hacker sitting in a different country can easily operate on a string of computers, infecting it and easily disabling it. In India, 'ransomware' is made worse because many computers might still be on Windows XP, for which Microsoft had not issued security updates for some time. However, after the cyber attack, Microsoft issued a security patch to Windows XP to fix the security vulnerability as computers worldwide were affected by the virus. Meanwhile, in Gujarat, the state government is now upgrading its computer systems with anti-virus software and updating the Microsoft OS as well. The ransomware virus had struck Britain's national health service(NHS) on Friday evening shutting down computer services in at at least 16 hospitals initially, severely disrupting emergency services which had to be suspended. Also Read: Infographic: How big a problem is ransomware? (WION with Agency inputs)

'Ransomware' hits West Bengal state electricity company, Kerala panchayat office

The Indonesian government said the global cyber attack that takes computer data hostage is likely to cause more havoc when offices reopen for business on Monday.

A large hospital in Jakarta was struck by the &quot;ransomware&quot; unleashed on Friday, but there has been no evidence so far to suggest that Indonesia was one of the worst-hit countries.&nbsp;

Communication and Information Minister Rudiantara urged companies to update their security before connecting computers to local area networks when the week starts.

&quot;This is crucial for businesses when reopening on Monday, please beware and anticipate, and take preventive steps against the WannaCry malware attack,&quot; Rudiantara told a news conference.

Cyber extortionists tricked victims into opening malicious malware attachments to spam emails. The ransomware encrypts data on computers, demanding payments of $300-$600 to restore access.

The attack, which leverages hacking tools believed to have been developed by the US&nbsp;National Security Agency, has infected tens of thousands of computers in nearly 100 countries.&nbsp;

Globally, hospitals, companies, and universities have been affected, with the most disruptive attacks reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday.&nbsp;

The Indonesian minister advised those hit by the malware against paying ransoms to regain access to encrypted data, as there was no guarantee the virus spreader would decrypt files.

On Saturday, an official at his ministry said that at least two Jakarta hospitals, Dharmais and Harapan Kita, were affected by the attack.&nbsp;

Harapan Kita later denied it had been affected.

In Dharmais, a nurse reported at 5 a m&nbsp;on Saturday that a computer unit was displaying a message demanding $300, according to a hospital staff member, who only gave his name as Willy.

An hour later, many more computers were found to be infected and hospital staff said that data was locked on about 400 units in all at the hospital.

The attack has not affected critical health services but has caused bottlenecks in patient admissions process, Willy said.&nbsp;

(Reuters)

The country's communication and information minister urged companies to update their security before connecting computers to local area networks when the week starts.

The Indonesian government said the global cyber attack that takes computer data hostage is likely to cause more havoc when offices reopen for business on Monday. A large hospital in Jakarta was struck by the "ransomware" unleashed on Friday, but there has been no evidence so far to suggest that Indonesia was one of the worst-hit countries. Communication and Information Minister Rudiantara urged companies to update their security before connecting computers to local area networks when the week starts. "This is crucial for businesses when reopening on Monday, please beware and anticipate, and take preventive steps against the WannaCry malware attack," Rudiantara told a news conference. Cyber extortionists tricked victims into opening malicious malware attachments to spam emails. The ransomware encrypts data on computers, demanding payments of $300-$600 to restore access. The attack, which leverages hacking tools believed to have been developed by the US National Security Agency, has infected tens of thousands of computers in nearly 100 countries. Globally, hospitals, companies, and universities have been affected, with the most disruptive attacks reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday. The Indonesian minister advised those hit by the malware against paying ransoms to regain access to encrypted data, as there was no guarantee the virus spreader would decrypt files. On Saturday, an official at his ministry said that at least two Jakarta hospitals, Dharmais and Harapan Kita, were affected by the attack. Harapan Kita later denied it had been affected. In Dharmais, a nurse reported at 5 a m on Saturday that a computer unit was displaying a message demanding $300, according to a hospital staff member, who only gave his name as Willy. An hour later, many more computers were found to be infected and hospital staff said that data was locked on about 400 units in all at the hospital. The attack has not affected critical health services but has caused bottlenecks in patient admissions process, Willy said. (Reuters)

Indonesia warns of more cyber attack havoc as business week starts

Germany urged its population to stockpile food and water to prepare for possible terrorist or cyber attacks yesterday. 
 
The citizens were encouraged to store food for 10 days and water to last five. 
 
This is the country&#39;s first civil defence strategy since the end of the Cold War. The plan marks the first broad update since 1995, when a dismantling of federal civil defence structures was advocated as security policies were eased in the wake of German reunification. 
 
The 69-page document said that Germany should be ready in case of an &quot;existence-threatening development&quot; and warned that the environment on which the security policy was previously based has changed. 
 
Chancellor Angela Merkel&#39;s &quot;grand&quot; right-left coalition of scaremongering was accused ahead of key state elections in September. 
 
Twitterati mocked the strategy with the hashtag #hamsterkaeufe (squirrelling away) and photos of the furry rodent widely circulating.
<blockquote class="twitter-tweet" data-lang="en">
Make Hamsterbacken great again. <a href="https://twitter.com/hashtag/Hamsterkaeufe?src=hash">#Hamsterkaeufe</a> <a href="https://t.co/CqZkG4pAxr">pic.twitter.com/CqZkG4pAxr</a>
&mdash; Schaf (@nordschaf) <a href="https://twitter.com/nordschaf/status/767458081034891264">August 21, 2016</a></blockquote>
&nbsp;

<blockquote class="twitter-tweet" data-lang="en">
<a href="https://twitter.com/hashtag/Hamsterkaeufe?src=hash">#Hamsterkaeufe</a> - beste Idee ever! <a href="https://t.co/mjSuLxJmhF">pic.twitter.com/mjSuLxJmhF</a>
&mdash; alex_dd (@alex_dd89) <a href="https://twitter.com/alex_dd89/status/767395394577915904">August 21, 2016</a></blockquote>
 
 
Interior minister Thomas de Maiziere rejected the criticism, saying that there must be preparation for any kind of disaster. 
 
&quot;It&#39;s only responsible, sensible and appropriate to make cool-headed preparations for a catastrophe scenario,&quot; he said, stressing that &quot;every country in the world does that&quot;. He also challenged charges of electioneering, arguing that the strategy is the result of a long reflection process that had been in 2012. 
 
While acknowledging that &quot;an attack on German territory requiring conventional defence is unlikely,&quot; Europe&#39;s biggest economy should be &quot;sufficiently prepared in case of an existence-threatening development in the future that cannot be ruled out,&quot; the strategy document said. 
 
&quot;The proliferation of weapons of mass destruction and their delivery systems, conflict driven by terrorist means and cyberspace attacks can be a direct threat to Germany and its allies,&quot; it said. 
 
de Maiziere said the strategy advocates emergency plans for any breakdown in key energy and water infrastructures as the people and the&nbsp;government was heavily dependent on both the power and IT networks&nbsp; 
 
A string of attacks at home in July - including two claimed by the Islamic State group - has sparked a fierce debate about internal security. 
 
The defence ministry is looking at training the military to respond to major terror assaults, while de Maiziere announced tough new anti-terror measures including a controversial proposal to strip jihadist fighters of their German nationality. 
 
Haunted by its Nazi past, Europe&#39;s most populous country has for decades been particularly cautious about military and defence issues. But this year it set out a new roadmap outlining Germany&#39;s ambition to assume a bigger security role abroad, within the frameworks of NATO and the European Union. 
 
(WION with inputs from AFP)

People were encouraged to stockpile for 10 days and water for five. This is the country's first civil defence strategy since Cold War

Germany urged its population to stockpile food and water to prepare for possible terrorist or cyber attacks yesterday. The citizens were encouraged to store food for 10 days and water to last five. This is the country's first civil defence strategy since the end of the Cold War. The plan marks the first broad update since 1995, when a dismantling of federal civil defence structures was advocated as security policies were eased in the wake of German reunification. The 69-page document said that Germany should be ready in case of an "existence-threatening development" and warned that the environment on which the security policy was previously based has changed. Chancellor Angela Merkel's "grand" right-left coalition of scaremongering was accused ahead of key state elections in September. Twitterati mocked the strategy with the hashtag #hamsterkaeufe (squirrelling away) and photos of the furry rodent widely circulating. Make Hamsterbacken great again. #Hamsterkaeufe pic.twitter.com/CqZkG4pAxr — Schaf (@nordschaf) August 21, 2016 #Hamsterkaeufe - beste Idee ever! pic.twitter.com/mjSuLxJmhF — alex_dd (@alex_dd89) August 21, 2016 Interior minister Thomas de Maiziere rejected the criticism, saying that there must be preparation for any kind of disaster. "It's only responsible, sensible and appropriate to make cool-headed preparations for a catastrophe scenario," he said, stressing that "every country in the world does that". He also challenged charges of electioneering, arguing that the strategy is the result of a long reflection process that had been in 2012. While acknowledging that "an attack on German territory requiring conventional defence is unlikely," Europe's biggest economy should be "sufficiently prepared in case of an existence-threatening development in the future that cannot be ruled out," the strategy document said. "The proliferation of weapons of mass destruction and their delivery systems, conflict driven by terrorist means and cyberspace attacks can be a direct threat to Germany and its allies," it said. de Maiziere said the strategy advocates emergency plans for any breakdown in key energy and water infrastructures as the people and the government was heavily dependent on both the power and IT networks A string of attacks at home in July - including two claimed by the Islamic State group - has sparked a fierce debate about internal security. The defence ministry is looking at training the military to respond to major terror assaults, while de Maiziere announced tough new anti-terror measures including a controversial proposal to strip jihadist fighters of their German nationality. Haunted by its Nazi past, Europe's most populous country has for decades been particularly cautious about military and defence issues. But this year it set out a new roadmap outlining Germany's ambition to assume a bigger security role abroad, within the frameworks of NATO and the European Union. (WION with inputs from AFP)

Stockpile food in case of attack, Germany tells citizens

The computer network used by Democratic presidential candidate Hillary Clinton&rsquo;s campaign was hacked as part of a broad cyber attack on Democratic political organisations, people familiar with the matter told Reuters. 
 
The latest attack, which was disclosed to Reuters yesterday, follows reports of two other hacks on the Democratic National Committee and the party&rsquo;s fundraising committee for candidates for the US House of Representatives. 
 
The US department of justice national security division is investigating whether cyber hacking attacks on Democratic political organisations threatened US security, sources familiar with the matter said yesterday. 
 
The involvement of the justice department&rsquo;s national security division is a sign that the Obama administration has concluded that the hacking was state sponsored, individuals with knowledge of the investigation said. 
 
The Clinton campaign, based in Brooklyn, had no immediate comment and referred Reuters to a comment from earlier this week by campaign senior policy adviser Jake Sullivan criticising Republican presidential candidate Donald Trump and calling the hacking &quot;a national security issue.&quot; 
 
The department of justice had no comment. 
 
It was not immediately clear what information on the Clinton campaign&rsquo;s computer system hackers would have been able to access. 
 
Hackers, whom US intelligence officials have concluded were Russian, gained access to the entire network of the fundraising Democratic Congressional Campaign Committee, of DCCC, said people familiar with the matter, detailing the extent of the breach to Reuters for the first time. 
 
Access to the full DCCC network would have given the hackers access to everything from emails to strategy memos and opposition research prepared to support Democratic candidates in campaigns for the House. 
 
The hack of the DCCC, which is based in Washington, was reported first by Reuters on Thursday, ahead of Clinton&rsquo;s speech in Philadelphia accepting the Democratic party&rsquo;s nomination. 
 
Russian officials could not be immediately reached for comment. 
 
The DCCC said in a statement early on Friday that it has hired cyber security firm CrowdStrike to investigate. 
 
&quot;We have taken and are continuing to take steps to enhance the security of our network,&quot; the DCCC said. &quot;We are cooperating with federal law enforcement with respect to their ongoing investigation.&quot; 
 
(Reuters)

It was not clear what information on the Clinton campaign?s computer system hackers would have been able to access

The computer network used by Democratic presidential candidate Hillary Clinton’s campaign was hacked as part of a broad cyber attack on Democratic political organisations, people familiar with the matter told Reuters. The latest attack, which was disclosed to Reuters yesterday, follows reports of two other hacks on the Democratic National Committee and the party’s fundraising committee for candidates for the US House of Representatives. The US department of justice national security division is investigating whether cyber hacking attacks on Democratic political organisations threatened US security, sources familiar with the matter said yesterday. The involvement of the justice department’s national security division is a sign that the Obama administration has concluded that the hacking was state sponsored, individuals with knowledge of the investigation said. The Clinton campaign, based in Brooklyn, had no immediate comment and referred Reuters to a comment from earlier this week by campaign senior policy adviser Jake Sullivan criticising Republican presidential candidate Donald Trump and calling the hacking "a national security issue." The department of justice had no comment. It was not immediately clear what information on the Clinton campaign’s computer system hackers would have been able to access. Hackers, whom US intelligence officials have concluded were Russian, gained access to the entire network of the fundraising Democratic Congressional Campaign Committee, of DCCC, said people familiar with the matter, detailing the extent of the breach to Reuters for the first time. Access to the full DCCC network would have given the hackers access to everything from emails to strategy memos and opposition research prepared to support Democratic candidates in campaigns for the House. The hack of the DCCC, which is based in Washington, was reported first by Reuters on Thursday, ahead of Clinton’s speech in Philadelphia accepting the Democratic party’s nomination. Russian officials could not be immediately reached for comment. The DCCC said in a statement early on Friday that it has hired cyber security firm CrowdStrike to investigate. "We have taken and are continuing to take steps to enhance the security of our network," the DCCC said. "We are cooperating with federal law enforcement with respect to their ongoing investigation." (Reuters)

Clinton campaign also hacked in attacks on Democrats

Increased technology usage and digitisation of the economy have escalated cyberattacks in India, and nearly 70 per cent of Nifty 50 companies are vulnerable to hackers, reveals a PwC survey. 
 
According to the report, out of the 50 companies studied, 34 (or 68 per cent) had identified vulnerabilities in at least one or more of their Internet-facing properties. 
 
The PwC survey about transgressions in Indian cyberspace of these companies further said, 525 email addresses belonging to the 34 companies were compromised, meaning hackers had access to those email addresses. 
 
&quot;Cybersecurity is no more restricted to Chief Information Officers (CIOs) or Chief Security Officers (CSOs) but needs serious attention of the higher management,&quot; Sivarama Krishnan, the leader of cyber security at PwC India said. 
 
Furthermore, 200 IP addresses belonging to the 34 companies were blacklisted by various Internet Service Providers (ISPs), implying that the ISPs found these IPs to be involved in spreading malicious traffic on the Internet, sending spam emails, or acting as a botnet in large cyber attacks, the report noted. 
 
&quot;There is a perceptible shift in the way modern threats are carried out, and the types of responses needed, and the surge in cyber crimes, manifests how these attackers are extensively-equipped with resources besides having a high technical skill set,&quot; Krishnan added. 
 
Sectorwise, media &amp; entertainment, automobiles, consumer goods and energy had the highest number of vulnerabilities. 
 
&quot;Hackers today are just not the tech enthusiasts, but are more sophisticated and organised in their approach to probe their targets and companies need to, more than ever before, adopt sophisticated security analytical tools to prevent such crimes,&quot; Krishnan said. 
 
According to the report, transgressions in Indian cyberspace have more than doubled over the past year to 6,284 incidents per respondent. The average number of attacks in India is fast catching up with the global average of 6,853 incidents per respondent. 
(PTI)

Transgressions in Indian cyberspace have more than doubled over the past year, a PricewaterhouseCoopers report says

Increased technology usage and digitisation of the economy have escalated cyberattacks in India, and nearly 70 per cent of Nifty 50 companies are vulnerable to hackers, reveals a PwC survey. According to the report, out of the 50 companies studied, 34 (or 68 per cent) had identified vulnerabilities in at least one or more of their Internet-facing properties. The PwC survey about transgressions in Indian cyberspace of these companies further said, 525 email addresses belonging to the 34 companies were compromised, meaning hackers had access to those email addresses. "Cybersecurity is no more restricted to Chief Information Officers (CIOs) or Chief Security Officers (CSOs) but needs serious attention of the higher management," Sivarama Krishnan, the leader of cyber security at PwC India said. Furthermore, 200 IP addresses belonging to the 34 companies were blacklisted by various Internet Service Providers (ISPs), implying that the ISPs found these IPs to be involved in spreading malicious traffic on the Internet, sending spam emails, or acting as a botnet in large cyber attacks, the report noted. "There is a perceptible shift in the way modern threats are carried out, and the types of responses needed, and the surge in cyber crimes, manifests how these attackers are extensively-equipped with resources besides having a high technical skill set," Krishnan added. Sectorwise, media & entertainment, automobiles, consumer goods and energy had the highest number of vulnerabilities. "Hackers today are just not the tech enthusiasts, but are more sophisticated and organised in their approach to probe their targets and companies need to, more than ever before, adopt sophisticated security analytical tools to prevent such crimes," Krishnan said. According to the report, transgressions in Indian cyberspace have more than doubled over the past year to 6,284 incidents per respondent. The average number of attacks in India is fast catching up with the global average of 6,853 incidents per respondent. (PTI)

Rising cyberattacks affect majority of India's big companies

North Korea hacked into more than 140,000 computers at 160 South Korean firms and government agencies, planting malicious code under a long-term plan laying groundwork for a massive cyber attack against its rival.

The hacking originated from an IP address traced to the North Korean capital and targeted network management software that is widely used by private companies and government agencies, police said, declining to identify the software.

The IP address was identical to one used in a 2013 cyber attack against South Korean banks and broadcasters that froze computer systems for more than a week.

South Korea has been on high-alert against cyber attacks by the North after Pyongyang conducted a nuclear test in January and a long-range rocket launch in February that led to new UN&nbsp;sanctions.

The North has always denied wrongdoing.

In the most recent case, documents stolen from the two conglomerates included blueprints for the wings of F-15 fighter jets.

Of the more than 42,000 materials stolen, more than 40,000 were defence-related.

South Korean media said the two conglomerates were the SK and Hanjin groups, but police declined to confirm that.

A spokesman at SK Holdings said four group affiliates were affected by the hacking but they worked with the police to quickly close the breach and the leaked documents were not classified.

A spokesman at Korean Air Lines, part of Hanjin Group, said the documents leaked from its network were not classified and no other group affiliates were affected.

A Defence Ministry official said none of the defence-related materials stolen was secret and there was no security breach.

The hacking began in 2014 and was detected in February&nbsp;after North Korea managed to steal information from two conglomerates including defence-related material, South Korea&#39;s police cyber investigation unit said.

&quot;There is a high possibility that the North aimed to cause confusion on a national scale by launching a simultaneous attack after securing many targets of cyber terror, or intended to continuously steal industrial and military secrets,&quot; the unit&nbsp;said.

The hackers took no action after gaining control of servers and computers at some corporate groups and waited&nbsp;as they continued to hack into more targets in what police said was likely an effort to build the scale of a planned attack.

Reclusive North Korea and the rich, democratic South are technically still at war because their 1950-53 conflict ended in an armistice, not a peace treaty. The North regularly threatens to destroy the South and its main ally, the United States.

In March, the South&#39;s spy agency said it had intercepted an attempt to hack into South Korean computer networks to attack the transport system&#39;s control network, blaming the North for the attempt.

The United States accused North Korea of a cyber attack against Sony Pictures in 2014 that led to the studio cancelling the release of a comedy based on the fictional assassination of leader Kim Jong Un. North Korea denied the accusation. South Korea blamed the North for that attack, and the North denied responsibility.

Police said they worked with the affected companies and agencies to neutralise the malicious codes and prevent them from being used in a large-scale cyber attack.

The cyber-attack involved a theft of 42,000+ South Korean official documents with 95% of them being defence-related

North Korea hacked into more than 140,000 computers at 160 South Korean firms and government agencies, planting malicious code under a long-term plan laying groundwork for a massive cyber attack against its rival. The hacking originated from an IP address traced to the North Korean capital and targeted network management software that is widely used by private companies and government agencies, police said, declining to identify the software. The IP address was identical to one used in a 2013 cyber attack against South Korean banks and broadcasters that froze computer systems for more than a week. South Korea has been on high-alert against cyber attacks by the North after Pyongyang conducted a nuclear test in January and a long-range rocket launch in February that led to new UN sanctions. The North has always denied wrongdoing. In the most recent case, documents stolen from the two conglomerates included blueprints for the wings of F-15 fighter jets. Of the more than 42,000 materials stolen, more than 40,000 were defence-related. South Korean media said the two conglomerates were the SK and Hanjin groups, but police declined to confirm that. A spokesman at SK Holdings said four group affiliates were affected by the hacking but they worked with the police to quickly close the breach and the leaked documents were not classified. A spokesman at Korean Air Lines, part of Hanjin Group, said the documents leaked from its network were not classified and no other group affiliates were affected. A Defence Ministry official said none of the defence-related materials stolen was secret and there was no security breach. The hacking began in 2014 and was detected in February after North Korea managed to steal information from two conglomerates including defence-related material, South Korea's police cyber investigation unit said. "There is a high possibility that the North aimed to cause confusion on a national scale by launching a simultaneous attack after securing many targets of cyber terror, or intended to continuously steal industrial and military secrets," the unit said. The hackers took no action after gaining control of servers and computers at some corporate groups and waited as they continued to hack into more targets in what police said was likely an effort to build the scale of a planned attack. Reclusive North Korea and the rich, democratic South are technically still at war because their 1950-53 conflict ended in an armistice, not a peace treaty. The North regularly threatens to destroy the South and its main ally, the United States. In March, the South's spy agency said it had intercepted an attempt to hack into South Korean computer networks to attack the transport system's control network, blaming the North for the attempt. The United States accused North Korea of a cyber attack against Sony Pictures in 2014 that led to the studio cancelling the release of a comedy based on the fictional assassination of leader Kim Jong Un. North Korea denied the accusation. South Korea blamed the North for that attack, and the North denied responsibility. Police said they worked with the affected companies and agencies to neutralise the malicious codes and prevent them from being used in a large-scale cyber attack.

North Korea hacks South Korea

cyber-attack

Cyber Attack, News on Cyber Attack, stories on Cyber Attack, articles on Cyber Attack, Cyber Attack stories at Wion, Cyber Attack news, Cyber Attack latest news