A controversial law that would allow Russia to cut internet traffic from international servers came into force Friday, prompting fears from rights activists of online isolation.

The law, which President Vladimir Putin signed in May, requires Russian internet providers to install technical devices provided by the authorities to enable centralised control of traffic.&nbsp;

They will also filter content to prevent access to banned websites.&nbsp;

Supporters of the legislation say the aim is to ensure Russian sites keep working if they are unable to connect to international servers or in the case of a threat from abroad such as cyber-attacks.

But rights activists say it is another censorship bid following previous efforts in Russia to block services such as the LinkedIn social media site and the Telegram messenger service.

Human Rights Watch warned that the law means the "Russian&nbsp;government will gain even greater control over freedom of speech and information online".

'Directly censor content'

The internet is the country's main forum for political debate and opposing voices as well as coordinating opposition demonstrations.

"Now the government can directly censor content or even turn Russia's internet into a closed system without telling the public what they are doing or why," said HRW's deputy Europe and Central Asian editor Rachel Denber.

The bill prompted thousands of people to join street protests in Moscow and other cities in March, with some comparing it to China's Great Firewall, which heavily restricts internet access.

The Kremlin has insisted it has no desire to isolate Russian internet users.

"No one is suggesting cutting the internet," spokesman Dmitry Peskov has said, accusing protesters of suffering from "delusions."

The bill's authors say the aim is to protect the country's websites from external threats and ensure the functioning of the internet is "safe and stable."

In the event of "threats to the stability, security and integrity" of the internet in Russia, the authorities can establish centralised control by the state telecommunications watchdog.

Internet providers have to take part in annual drills to test the technical devices needed for this.

These devices have not yet been installed by internet providers, however, and are currently being tested, the RBK business daily reported.

One of the law's authors, nationalist lawmaker Andrei Lugovoi, is a key suspect in the 2006 murder of Kremlin critic Alexander Litvinenko in Britain.&nbsp;

A controversial law that would allow Russia to cut internet traffic from international servers came into force Friday, prompting fears from rights activists of online isolation.

A controversial law that would allow Russia to cut internet traffic from international servers came into force Friday, prompting fears from rights activists of online isolation. The law, which President Vladimir Putin signed in May, requires Russian internet providers to install technical devices provided by the authorities to enable centralised control of traffic. They will also filter content to prevent access to banned websites. Supporters of the legislation say the aim is to ensure Russian sites keep working if they are unable to connect to international servers or in the case of a threat from abroad such as cyber-attacks. But rights activists say it is another censorship bid following previous efforts in Russia to block services such as the LinkedIn social media site and the Telegram messenger service. Human Rights Watch warned that the law means the "Russian government will gain even greater control over freedom of speech and information online". 'Directly censor content' The internet is the country's main forum for political debate and opposing voices as well as coordinating opposition demonstrations. "Now the government can directly censor content or even turn Russia's internet into a closed system without telling the public what they are doing or why," said HRW's deputy Europe and Central Asian editor Rachel Denber. The bill prompted thousands of people to join street protests in Moscow and other cities in March, with some comparing it to China's Great Firewall, which heavily restricts internet access. The Kremlin has insisted it has no desire to isolate Russian internet users. "No one is suggesting cutting the internet," spokesman Dmitry Peskov has said, accusing protesters of suffering from "delusions." The bill's authors say the aim is to protect the country's websites from external threats and ensure the functioning of the internet is "safe and stable." In the event of "threats to the stability, security and integrity" of the internet in Russia, the authorities can establish centralised control by the state telecommunications watchdog. Internet providers have to take part in annual drills to test the technical devices needed for this. These devices have not yet been installed by internet providers, however, and are currently being tested, the RBK business daily reported. One of the law's authors, nationalist lawmaker Andrei Lugovoi, is a key suspect in the 2006 murder of Kremlin critic Alexander Litvinenko in Britain.

Controversial Russian law to control internet now enforced

Two-thirds of those caught up in the past week&#39;s global ransomware attack were running Microsoft&#39;s Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found.

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying &quot;patient zero&quot; could help catch its criminal authors.

They are having more luck dissecting flaws that limited its spread.

Security experts warn that while computers at more than 3,00,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences.

&quot;Some organisations just aren&#39;t aware of the risks; some don&#39;t want to risk interrupting important business processes; sometimes they are short-staffed,&quot; said Ziv Mador, vice president of security research at Israel&#39;s SpiderLabs Trustwave.

&quot;There are plenty of reasons people wait to patch and none of them are good,&quot; said Mador, a former long-time security researcher for Microsoft.

WannaCry&#39;s worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations &amp; incident response at UK consulting firm MWR InfoSecurity.

Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users.

Computers running older versions, such as Windows XP used in Britain&#39;s NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported.

In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread.

Windows 10, the latest version of Microsoft&#39;s flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated.

Computer basics

Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled &ldquo;critical&rdquo; when it was released on March 14 on all computers on their networks are immune, experts agree.

Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs.

&quot;Clearly people who run supported versions of Windows and patched quickly were not affected&quot;, Trustwave&#39;s Mador said.

Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts.

Seeking to head off further criticism in the wake of the WannaCry outbreak, the US&nbsp;software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers.

Microsoft declined to comment for this story.

On Sunday, the US&nbsp;software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet.

Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said.

Dumb and sophisticated

The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from the US&nbsp;National Security Agency, creating a vastly potent class of crimeware.

&quot;What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption&quot;, said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic.

Last Friday, the company&#39;s British-based 22-year-old data breach research chief, Marcus Hutchins, created a &quot;kill-switch&quot;, which security experts have widely hailed as the decisive step in halting the ransomware&#39;s rapid spread around the globe.

WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home.

An unknown number of computers sit behind the 3,00,000 infected internet connections identified by Kryptos.

Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday.

Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: &quot;The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies.&quot;

Escape route

Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed.

However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: &quot;Users unlikely to get files restored&quot;, the company&#39;s Security Response team tweeted.

The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said.

While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree.

These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims.

Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever.

The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches.

WannaCry landed nine weeks after Microsoft&#39;s patch arrived.

&quot;The same things are causing the same problems. That&#39;s what the data shows,&quot; MWR research head Pratley said.

&quot;We haven&#39;t seen many organisations fall over and that&#39;s because they did some of the security basics,&quot; he said.

(Reuters)

Researchers are struggling to try to find early traces of WannaCry

Two-thirds of those caught up in the past week's global ransomware attack were running Microsoft's Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found. Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying "patient zero" could help catch its criminal authors. They are having more luck dissecting flaws that limited its spread. Security experts warn that while computers at more than 3,00,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences. "Some organisations just aren't aware of the risks; some don't want to risk interrupting important business processes; sometimes they are short-staffed," said Ziv Mador, vice president of security research at Israel's SpiderLabs Trustwave. "There are plenty of reasons people wait to patch and none of them are good," said Mador, a former long-time security researcher for Microsoft. WannaCry's worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations & incident response at UK consulting firm MWR InfoSecurity. Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users. Computers running older versions, such as Windows XP used in Britain's NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported. In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread. Windows 10, the latest version of Microsoft's flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated. Computer basics Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled “critical” when it was released on March 14 on all computers on their networks are immune, experts agree. Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs. "Clearly people who run supported versions of Windows and patched quickly were not affected", Trustwave's Mador said. Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts. Seeking to head off further criticism in the wake of the WannaCry outbreak, the US software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers. Microsoft declined to comment for this story. On Sunday, the US software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet. Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic. By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said. Dumb and sophisticated The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from the US National Security Agency, creating a vastly potent class of crimeware. "What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption", said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic. Last Friday, the company's British-based 22-year-old data breach research chief, Marcus Hutchins, created a "kill-switch", which security experts have widely hailed as the decisive step in halting the ransomware's rapid spread around the globe. WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home. An unknown number of computers sit behind the 3,00,000 infected internet connections identified by Kryptos. Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday. Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: "The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies." Escape route Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed. However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: "Users unlikely to get files restored", the company's Security Response team tweeted. The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said. While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree. These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims. Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches. WannaCry landed nine weeks after Microsoft's patch arrived. "The same things are causing the same problems. That's what the data shows," MWR research head Pratley said. "We haven't seen many organisations fall over and that's because they did some of the security basics," he said. (Reuters)

WannaCry: Security experts find clues to ransomware worm's lingering risks

Renault&nbsp;said 90 per cent of its factories were running normally on Monday morning after the French carmaker had earlier halted production at sites in France and Romania to prevent the spread of &#39;WannaCry&#39; ransomware.

Renault&#39;s decision to temporarily halt manufacturing came after a worldwide cyber attack that locked up computers in more than 150 countries, causing widespread disruption.

Computers around the globe were hacked beginning Friday using a security flaw in Microsoft&#39;s Windows XP operating system, an older version that was no longer given mainstream tech support by the US giant. Dubbed WannaCry, the ransomware attack affected more than 2,00,000 computers worldwide over the weekend

The ransomware locks access to user files and demands money - in the form of the virtual currency Bitcoin - in order to decrypt them.

Experts have been scrambling to determine who is behind the attack. Companies have warned users and staff not to click on attachments or links.

(WION with inputs from Reuters)

Computers around the globe were hacked beginning Friday using a security flaw in Microsoft's Windows XP operating system

Renault said 90 per cent of its factories were running normally on Monday morning after the French carmaker had earlier halted production at sites in France and Romania to prevent the spread of 'WannaCry' ransomware. Renault's decision to temporarily halt manufacturing came after a worldwide cyber attack that locked up computers in more than 150 countries, causing widespread disruption. Computers around the globe were hacked beginning Friday using a security flaw in Microsoft's Windows XP operating system, an older version that was no longer given mainstream tech support by the US giant. Dubbed WannaCry, the ransomware attack affected more than 2,00,000 computers worldwide over the weekend The ransomware locks access to user files and demands money - in the form of the virtual currency Bitcoin - in order to decrypt them. Experts have been scrambling to determine who is behind the attack. Companies have warned users and staff not to click on attachments or links. (WION with inputs from Reuters)

Renault production resumed at most sites after WannaCry ransomware attack

Asian governments and businesses reported some disruptions from the WannaCry ransomware worm on Monday but cybersecurity experts warned of a wider impact as more employees turned on their computers and checked e-mails.

The ransomware that has locked up more than 200,000 computers in more than 150 countries has been mainly spread by e-mail, hitting factories, hospitals, shops and schools worldwide.

&quot;Most of the attacks are arriving via e-mail, so there are many &#39;landmines&#39; waiting in people&#39;s in-boxes,&quot; said Michael Gazeley, managing director of Network Box, a Hong Kong-based cybersecurity company.

In China, the world&#39;s second-largest economy, energy giant PetroChina said payment systems at some of its petrol stations were hit, although it had been able to restore most of the systems. Several Chinese government bodies, including police and traffic authorities, reported they had been impacted by the hack, according to posts on official microblogs.

The official China Daily newspaper, citing Chinese tech firm Qihoo 360, said that at least 200,000 computers had been affected in China, with schools and colleges particularly hard-hit.

A spokesman for the Hong Kong Exchanges and Clearing, one of the region&#39;s biggest bourses, said all systems were so far working normally. &quot;We remain highly vigilant,&quot; he said.

Companies have warned users and staff not to click on attachments or links. One school in South Korea barred its pupils from using the internet. Taiwan&#39;s government appeared to have escaped major infection, possibly because regulations there require all departments to install software updates as soon as they are available.

South Korea&#39;s presidential Blue House office said nine cases of ransomware were found in the country, but did not provide details on where the cyber attacks were discovered.

In Australia, Dan Tehan, the government minister responsible for cybersecurity, said just three businesses had been hit by the bug, despite worries of widespread infection. There were no reported cases in New Zealand.

Brief respite

Cyber security experts said the spread of the ransomware had slowed since its appearance on Friday but that the respite might only be brief.

For one thing, the attackers or copycat attackers may have developed new versions of the worm, although a British-based security researcher who thwarted an earlier version of the worm told Reuters most of these reports had been proven false.

In Hong Kong, Gazeley said his team had found a new version of the worm that didn&#39;t use e-mail to lure victims.

Instead, it loaded scripts onto hacked websites where users who clicked on a malicious link would be infected directly. He said it was too early to tell how many websites had been affected.

Gazeley added that several major companies in Asia had been hit by the ransomware, but &quot;the last thing they want to do is come out in public and admit it.&quot; He declined to elaborate.

In a blog post on Sunday, Microsoft President Brad Smith appeared to tacitly acknowledge what researchers had already widely concluded: The ransomware attack leveraged a hacking tool built by the US&nbsp;National Security Agency, that leaked online in April.

The non-profit US&nbsp;Cyber Consequences Unit research institute estimated that total losses would range in the hundreds of millions of dollars, but not exceed $1 billion.

Most victims were quickly able to recover infected systems with backups, said the group&#39;s chief economist, Scott Borg.

Infected computers appear to largely be out-of-date devices that organisations deemed not worth the price of upgrading or, in some cases, machines involved in manufacturing or hospital functions that proved too difficult to patch without possibly disrupting crucial operations, security experts said.

Microsoft released patches last month and on Friday to fix a vulnerability that allowed the worm to spread across networks, a rare and powerful feature that caused infections to surge on Friday.

(Reuters)

WannaCry ransomeware affects Asian business; wider impact expected

Asian governments and businesses reported some disruptions from the WannaCry ransomware worm on Monday but cybersecurity experts warned of a wider impact as more employees turned on their computers and checked e-mails. The ransomware that has locked up more than 200,000 computers in more than 150 countries has been mainly spread by e-mail, hitting factories, hospitals, shops and schools worldwide. "Most of the attacks are arriving via e-mail, so there are many 'landmines' waiting in people's in-boxes," said Michael Gazeley, managing director of Network Box, a Hong Kong-based cybersecurity company. In China, the world's second-largest economy, energy giant PetroChina said payment systems at some of its petrol stations were hit, although it had been able to restore most of the systems. Several Chinese government bodies, including police and traffic authorities, reported they had been impacted by the hack, according to posts on official microblogs. The official China Daily newspaper, citing Chinese tech firm Qihoo 360, said that at least 200,000 computers had been affected in China, with schools and colleges particularly hard-hit. A spokesman for the Hong Kong Exchanges and Clearing, one of the region's biggest bourses, said all systems were so far working normally. "We remain highly vigilant," he said. Companies have warned users and staff not to click on attachments or links. One school in South Korea barred its pupils from using the internet. Taiwan's government appeared to have escaped major infection, possibly because regulations there require all departments to install software updates as soon as they are available. South Korea's presidential Blue House office said nine cases of ransomware were found in the country, but did not provide details on where the cyber attacks were discovered. In Australia, Dan Tehan, the government minister responsible for cybersecurity, said just three businesses had been hit by the bug, despite worries of widespread infection. There were no reported cases in New Zealand. Brief respite Cyber security experts said the spread of the ransomware had slowed since its appearance on Friday but that the respite might only be brief. For one thing, the attackers or copycat attackers may have developed new versions of the worm, although a British-based security researcher who thwarted an earlier version of the worm told Reuters most of these reports had been proven false. In Hong Kong, Gazeley said his team had found a new version of the worm that didn't use e-mail to lure victims. Instead, it loaded scripts onto hacked websites where users who clicked on a malicious link would be infected directly. He said it was too early to tell how many websites had been affected. Gazeley added that several major companies in Asia had been hit by the ransomware, but "the last thing they want to do is come out in public and admit it." He declined to elaborate. In a blog post on Sunday, Microsoft President Brad Smith appeared to tacitly acknowledge what researchers had already widely concluded: The ransomware attack leveraged a hacking tool built by the US National Security Agency, that leaked online in April. The non-profit US Cyber Consequences Unit research institute estimated that total losses would range in the hundreds of millions of dollars, but not exceed $1 billion. Most victims were quickly able to recover infected systems with backups, said the group's chief economist, Scott Borg. Infected computers appear to largely be out-of-date devices that organisations deemed not worth the price of upgrading or, in some cases, machines involved in manufacturing or hospital functions that proved too difficult to patch without possibly disrupting crucial operations, security experts said. Microsoft released patches last month and on Friday to fix a vulnerability that allowed the worm to spread across networks, a rare and powerful feature that caused infections to surge on Friday. (Reuters)

internet-attack

Internet Attack, News on Internet Attack, stories on Internet Attack, articles on Internet Attack, Internet Attack stories at Wion, Internet Attack news, Internet Attack latest news

internet attack

Controversial Russian law to control internet now enforced

WannaCry: Security experts find clues to ransomware worm's lingering risks

Renault production resumed at most sites after WannaCry ransomware attack

WannaCry ransomeware affects Asian business; wider impact expected