US slams China for corporate cyber espionage, indicts two spies

Two-thirds of those caught up in the past week&#39;s global ransomware attack were running Microsoft&#39;s Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found.

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying &quot;patient zero&quot; could help catch its criminal authors.

They are having more luck dissecting flaws that limited its spread.

Security experts warn that while computers at more than 300,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences.

&quot;Some organisations just aren&#39;t aware of the risks; some don&#39;t want to risk interrupting important business processes; sometimes they are short-staffed,&quot; said Ziv Mador, vice president of security research at Israel&#39;s SpiderLabs Trustwave.

&quot;There are plenty of reasons people wait to patch and none of them are good,&quot; said Mador, a former long-time security researcher for Microsoft.

WannaCry&#39;s worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations &amp; incident response at UK consulting firm MWR InfoSecurity.

Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users.

Computers running older versions, such as Windows XP used in Britain&#39;s NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported.

In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread.

Windows 10, the latest version of Microsoft&#39;s flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated.

Computer basics

Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled &ldquo;critical&rdquo; when it was released on March 14 on all computers on their networks are immune, experts agree.

Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs.

&quot;Clearly people who run supported versions of Windows and patched quickly were not affected&quot;, Trustwave&#39;s Mador said.

Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts.

Seeking to head off further criticism in the wake of the WannaCry outbreak, the US&nbsp;software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers.

Microsoft declined to comment for this story.

On Sunday, the US&nbsp;software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet.

Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said.

Dumb and sophisticated

The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from theS&nbsp;National Security Agency, creating a vastly potent class of crimeware.

&quot;What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption&quot;, said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic.

Last Friday, the company&#39;s British-based 22-year-old data breach research chief, Marcus Hutchins, created a &quot;kill-switch&quot;, which security experts have widely hailed as the decisive step in halting the ransomware&#39;s rapid spread around the globe.

WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home.

An unknown number of computers sit behind the 300,000 infected internet connections identified by Kryptos.

Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday.

Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: &quot;The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies.&quot;

Escape route

Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed.

However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: &quot;Users unlikely to get files restored&quot;, the company&#39;s Security Response team tweeted.

The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said.

While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree.

These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims.

Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. (Reuters graphic: [http://tmsnrt.rs/2rqaLyz)

The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches.

WannaCry landed nine weeks after Microsoft&#39;s patch arrived.

&quot;The same things are causing the same problems. That&#39;s what the data shows,&quot; MWR research head Pratley said.

&quot;We haven&#39;t seen many organisations fall over and that&#39;s because they did some of the security basics,&quot; he said.

(Reuters)

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia

Two-thirds of those caught up in the past week's global ransomware attack were running Microsoft's Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found. Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying "patient zero" could help catch its criminal authors. They are having more luck dissecting flaws that limited its spread. Security experts warn that while computers at more than 300,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences. "Some organisations just aren't aware of the risks; some don't want to risk interrupting important business processes; sometimes they are short-staffed," said Ziv Mador, vice president of security research at Israel's SpiderLabs Trustwave. "There are plenty of reasons people wait to patch and none of them are good," said Mador, a former long-time security researcher for Microsoft. WannaCry's worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations & incident response at UK consulting firm MWR InfoSecurity. Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users. Computers running older versions, such as Windows XP used in Britain's NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported. In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread. Windows 10, the latest version of Microsoft's flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated. Computer basics Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled “critical” when it was released on March 14 on all computers on their networks are immune, experts agree. Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs. "Clearly people who run supported versions of Windows and patched quickly were not affected", Trustwave's Mador said. Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts. Seeking to head off further criticism in the wake of the WannaCry outbreak, the US software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers. Microsoft declined to comment for this story. On Sunday, the US software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet. Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic. By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said. Dumb and sophisticated The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from theS National Security Agency, creating a vastly potent class of crimeware. "What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption", said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic. Last Friday, the company's British-based 22-year-old data breach research chief, Marcus Hutchins, created a "kill-switch", which security experts have widely hailed as the decisive step in halting the ransomware's rapid spread around the globe. WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home. An unknown number of computers sit behind the 300,000 infected internet connections identified by Kryptos. Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday. Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: "The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies." Escape route Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed. However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: "Users unlikely to get files restored", the company's Security Response team tweeted. The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said. While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree. These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims. Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. (Reuters graphic: [http://tmsnrt.rs/2rqaLyz) The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches. WannaCry landed nine weeks after Microsoft's patch arrived. "The same things are causing the same problems. That's what the data shows," MWR research head Pratley said. "We haven't seen many organisations fall over and that's because they did some of the security basics," he said. (Reuters)

Security experts find clues to ransomware worm's lingering risks

As part of precautionary measures, banks in India did not operate some ATMs running on old software in view of threat from ransomware &#39;WannaCry&#39;.

The Reserve Bank of India&nbsp;has asked banks to follow the instructions of government organisation CERT-In on ransomware, which has impacted various IT networks in over 150 countries.

Indian Computer Emergency Response Team (CERT-In) has come out with a list of dos and dont&#39;s and webcast on how to protect networks from the global ransomware attack.

Most automated teller machines (ATMs) were running fine, there could be some which may not have updated Microsoft&#39;s Windows operating system, sources said.

Such ATMs could be prone to attack so as precautionary measure banks running such ATMs refrained from feeding cash, sources added.

However, there was no official information from the RBI in this connection till late evening.

There are a total of 2.2 lakh ATMs in India, of which few may be running on old Windows XP.

In a separate malware attack last year, 3.2 lakh debit cards were compromised in the country.

Data of the users who transacted from ATM machines of Hitachi were compromised during three months of May, June and July last year.

The Hitachi ATMs deployed by many White Label ATM players and Yes Bank were impacted by the malware.

Indian computer systems largely escaped a global ransomware attack as the government and companies installed security patches to gain an upper hand against the first wave of an unrivalled global cyber-attack.

Over two lakh computers in at least 150 countries are said to have been infected, according to Europol, the European Union&#39;s law enforcement agency. In India, only a few isolated incidents in Kerala, Andhra Pradesh and Tamil Nadu were reported.

National Informatics Centre, which manages government websites, and the Centre for Development of Advanced Computing installed security patches issued by Microsoft to immunise their Windows systems.

Also, guidelines were issued to enable large IT networks to tackle the threat.

&quot;There is no major impact in India unlike other countries. We are keeping a close watch. As per the information received so far, there have been isolated incidents in limited areas in Kerala and Andhra Pradesh,&quot; Information and Technology Minister Ravi Shankar Prasad told reporters.

He said a cyber coordination centre will start operating from next month to take precautions against such attacks. India&#39;s cyber security unit CERT-In said it has received formal reports of just five &quot;incidents&quot; across locations like Delhi and Tamil Nadu.

&quot;It is nothing major, but we are still watching. The next couple of days, we will be on alert on this,&quot; Indian Computer Emergency Response Team (CERT-In), director general, Sanjay Bahl told PTI.

India is on high alert, monitoring critical networks across sectors like banking, telecom, power and aviation to ensure that systems are protected against the attack that has claimed victims in more than 150 countries over the weekend.

The Reserve Bank of India (RBI) asked banks to follow the instructions issued by CERT-In to prevent the attack. A few ATMs running on old Microsoft Operating System remained non-operational as part of precautionary measures.

CERT-In has issued list of dos and don&#39;ts and webcast on how to protect networks from the global ransomware attack.

India Inc has also been on the vigil against &#39;WannaCry&#39;, which has claimed victims in over 150 countries like Spanish telecom firm Telefonica, US&#39; logistics major FedEx and Russia&#39;s interior ministry.

Auto maker Nissan, which saw its systems being impacted globally, said the Renault-Nissan alliance plant in Chennai came under attack but its India team has responded and there is no major impact on business.

&quot;Normal production operations are underway at our RNAIPL plant in Chennai,&quot; Nissan India said in an emailed statement. Indian IT companies like Infosys and Wipro are also monitoring their systems and taking necessary precautions to ensure business continuity for their clients.

&quot;The Indian IT industry should be better placed than others (in handling the situation). We have not come across any significant impact yet,&quot; Nasscom President, R Chandrasekhar said.

Hackers possibly used techniques stolen from the US National Security Agency to encrypt files within affected computers, making them inaccessible, and demanded USD 300 ransom.

&quot;WannaCry is just the tip of the iceberg and organisations need to re-assess the security programme and strengthen detection, prevention and response capabilities to counter such attacks,&quot; Deloitte Touche Tohmatsu India Partner Shree Parthasarathy said.

GSTN, the company set up to provide the IT infrastructure for GST rollout, will not be impacted by the WannaCry ransomware attack as its systems do not run on Microsoft software, its CEO Prakash Kumar said.

Meanwhile, IT Secretary Aruna Sundararajan said the IT Ministry along with CERT-In is closely monitoring the situation and reiterated that no large-scale incidents were reported in public and private sectors.

Report by various security solutions firms over the weekend had claimed that India is amongst the countries worst affected by the &#39;WannaCry&#39; outbreak, accounting for about five per cent of the attacks.

(PTI)

Most ATMs are running fine, but some which may not have the updated Microsoft's Windows operating system, could be prone to attack

As part of precautionary measures, banks in India did not operate some ATMs running on old software in view of threat from ransomware 'WannaCry'. The Reserve Bank of India has asked banks to follow the instructions of government organisation CERT-In on ransomware, which has impacted various IT networks in over 150 countries. Indian Computer Emergency Response Team (CERT-In) has come out with a list of dos and dont's and webcast on how to protect networks from the global ransomware attack. Most automated teller machines (ATMs) were running fine, there could be some which may not have updated Microsoft's Windows operating system, sources said. Such ATMs could be prone to attack so as precautionary measure banks running such ATMs refrained from feeding cash, sources added. However, there was no official information from the RBI in this connection till late evening. There are a total of 2.2 lakh ATMs in India, of which few may be running on old Windows XP. In a separate malware attack last year, 3.2 lakh debit cards were compromised in the country. Data of the users who transacted from ATM machines of Hitachi were compromised during three months of May, June and July last year. The Hitachi ATMs deployed by many White Label ATM players and Yes Bank were impacted by the malware. Indian computer systems largely escaped a global ransomware attack as the government and companies installed security patches to gain an upper hand against the first wave of an unrivalled global cyber-attack. Over two lakh computers in at least 150 countries are said to have been infected, according to Europol, the European Union's law enforcement agency. In India, only a few isolated incidents in Kerala, Andhra Pradesh and Tamil Nadu were reported. National Informatics Centre, which manages government websites, and the Centre for Development of Advanced Computing installed security patches issued by Microsoft to immunise their Windows systems. Also, guidelines were issued to enable large IT networks to tackle the threat. "There is no major impact in India unlike other countries. We are keeping a close watch. As per the information received so far, there have been isolated incidents in limited areas in Kerala and Andhra Pradesh," Information and Technology Minister Ravi Shankar Prasad told reporters. He said a cyber coordination centre will start operating from next month to take precautions against such attacks. India's cyber security unit CERT-In said it has received formal reports of just five "incidents" across locations like Delhi and Tamil Nadu. "It is nothing major, but we are still watching. The next couple of days, we will be on alert on this," Indian Computer Emergency Response Team (CERT-In), director general, Sanjay Bahl told PTI. India is on high alert, monitoring critical networks across sectors like banking, telecom, power and aviation to ensure that systems are protected against the attack that has claimed victims in more than 150 countries over the weekend. The Reserve Bank of India (RBI) asked banks to follow the instructions issued by CERT-In to prevent the attack. A few ATMs running on old Microsoft Operating System remained non-operational as part of precautionary measures. CERT-In has issued list of dos and don'ts and webcast on how to protect networks from the global ransomware attack. India Inc has also been on the vigil against 'WannaCry', which has claimed victims in over 150 countries like Spanish telecom firm Telefonica, US' logistics major FedEx and Russia's interior ministry. Auto maker Nissan, which saw its systems being impacted globally, said the Renault-Nissan alliance plant in Chennai came under attack but its India team has responded and there is no major impact on business. "Normal production operations are underway at our RNAIPL plant in Chennai," Nissan India said in an emailed statement. Indian IT companies like Infosys and Wipro are also monitoring their systems and taking necessary precautions to ensure business continuity for their clients. "The Indian IT industry should be better placed than others (in handling the situation). We have not come across any significant impact yet," Nasscom President, R Chandrasekhar said. Hackers possibly used techniques stolen from the US National Security Agency to encrypt files within affected computers, making them inaccessible, and demanded USD 300 ransom. "WannaCry is just the tip of the iceberg and organisations need to re-assess the security programme and strengthen detection, prevention and response capabilities to counter such attacks," Deloitte Touche Tohmatsu India Partner Shree Parthasarathy said. GSTN, the company set up to provide the IT infrastructure for GST rollout, will not be impacted by the WannaCry ransomware attack as its systems do not run on Microsoft software, its CEO Prakash Kumar said. Meanwhile, IT Secretary Aruna Sundararajan said the IT Ministry along with CERT-In is closely monitoring the situation and reiterated that no large-scale incidents were reported in public and private sectors. Report by various security solutions firms over the weekend had claimed that India is amongst the countries worst affected by the 'WannaCry' outbreak, accounting for about five per cent of the attacks. (PTI)

WannaCry: Some banks shut ATMs, government says no major impact of ransomware attack in India

global-hacking

Global Hacking, News on Global Hacking, stories on Global Hacking, articles on Global Hacking, Global Hacking stories at Wion, Global Hacking news, Global Hacking latest news

global hacking

US slams China for corporate cyber espionage, indicts two spies

Security experts find clues to ransomware worm's lingering risks

WannaCry: Some banks shut ATMs, government says no major impact of ransomware attack in India