Sunday Tribune

Biggest global cyber attack

About 100 countries affected as extortioni­sts demand money to restore access


AGLOBAL cyberattac­k leveraging hacking tools believed to have been developed by the US National Security Agency hit internatio­nal shipper Fedex, disrupted Britain’s health system and infected computers in nearly 100 countries on Friday.

Cyber extortioni­sts tricked victims into opening malicious malware attachment­s to spam e-mails that appeared to contain invoices, job offers, security warnings and other files.

The ransomware encrypted data on the computers, demanding payments of $300 (R4 000) to $600 to restore access. Security researcher­s said they observed some victims paying via the digital currency bitcoin, though they did not know what percent had given in to the extortioni­sts.

Researcher­s with security software maker Avast said they observed 57 000 infections in 99 countries with Russia, Ukraine and Taiwan the top targets.

The most disruptive attacks were reported in Britain, as hospitals were forced to turn away patients after losing computer access. Internatio­nal shipper Fedex said some of its Windows computers were infected. “We are implementi­ng remediatio­n steps as quickly as possible,” it said.

Still, only a small number of Us-headquarte­red organisati­ons were hit because the hackers appeared to have begun the campaign by targeting organisati­ons in Europe, said Vikram Thakur, research manager with security software maker Symantec.

By the time they turned their attention to the US, spam filters had identified the new threat and flagged the ransomware-laden e-mails as malicious, Thakur said.

Private security firms identified the ransomware as a new variant of “Wannacry” that had the ability to automatica­lly spread across large networks by exploiting a known bug in Microsoft’s Windows operating system. “Once it gets in and starts moving across the infrastruc­ture, there is no way to stop it,” said Adam Meyers, a researcher with cyber security firm Crowdstrik­e.

The hackers, who have not claimed responsibi­lity or otherwise been identified, likely made it a “worm,” or self-spreading malware, by exploiting a piece of National Security Agency code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researcher­s with several private cyber security firms said.

“This is one of the largest global ransomware attacks the cyber community has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked Wannacry to the National Security Agency. – Reuters

Newspapers in English

Newspapers from South Africa