The world suffered another <a href="https://www.forbes.com/sites/thomasbrewster/2017/06/27/ransomware-spreads-rapidly-hitting-power-companies-banks-airlines-metro/" target="_blank" rel="noopener noreferrer">ransomware nightmare </a>on Tuesday, with pharmaceutical companies, Chernobyl radiation detection systems, the Kiev metro, an airport and banks all affected. One U.S. hospital also <a href="http://amp.wtae.com/article/cybersecurity-incident-heritage-valley-health-system/10228015" target="_blank" rel="noopener noreferrer">appears to be a victim</a>. Worse is expected, thanks to some pernicious features in the ransomware sample.
The malware widely believed to be responsible is a version of Petya which security researchers are calling &#8220;NotPetya&#8221;. It&#8217;s similar to Petya, but different enough to qualify as an entirely new form of ransomware, researchers say. Backing up NotPetya is an exploit method borrowed from a leaked <a href="https://www.forbes.com/sites/thomasbrewster/2017/05/12/nsa-exploit-used-by-wannacry-ransomware-in-global-explosion/" target="_blank" rel="noopener noreferrer">NSA hack called EternalBlue</a>, the same which WannaCry used to infect hundreds of thousands of computers and take down hospital networks. Though with the new strain, only computers on a local network are scanned, not the entire internet, as WannaCry attempted.
<a href="http://www.forbesafrica.com/technology/2017/06/28/mayday-mayday-ive-hacked/" target="_blank" rel="noopener noreferrer">Mayday! Mayday! I&#8217;ve Been Hacked</a>
That&#8217;s cause for embarrassment among infected companies: Microsoft <a href="https://www.forbes.com/sites/leemathews/2017/05/13/microsoft-update-wannacrypt-ransomware/" target="_self">released a patch</a> earlier this year which prevented any EternalBlue hacks, even pushing out updates for older, unsupported Windows systems like XP. Businesses should have patched by now, especially given the carnage WannaCry caused.
<h3>Extra powers</h3>
NotPetya has some extra powers that security experts say make it deadlier than WannaCry. While EternalBlue has allowed it to spread via a weakness in Windows&#8217; SMB, it has other tools for moving at speed across networks. For instance, according to former NSA analyst and cybersecurity entrepreneur David Kennedy, the ransomware finds passwords on the infected computer to move to other systems. It does that by extracting passwords from memory or from the local filesystem, he explained.
<blockquote>&#8220;This is going to be a big one. Real big one,&#8221; Kennedy added.</blockquote>
Another proliferation technique is NotPetya&#8217;s abuse of <a href="https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx" target="_blank" rel="noopener noreferrer">PsExec</a>. The tool is meant to carry out limited actions on other systems, but in this case its  spreading the infection by executing malicious code on other computers. For instance, if the infected PC has administrator access to the network, every computer can become infected. A similar method is used by NotPetya with the Windows Management Instrumentation (WMI) tool, <a href="https://twitter.com/GossiTheDog/status/879761465061904394" target="_blank" rel="noopener noreferrer">according to security expert Kevin Beaumont</a>.
&#8220;This dangerous combination may be the reason why this outbreak has spread globally and rapidly, even after the previous outbreaks have generated media headlines and hopefully most vulnerabilities have been patched,&#8221; said ESET researcher Robert Lipovsky. &#8220;It only takes one unpatched computer to get inside the network, and the malware can get administrator rights and spread to other computers.&#8221;
Perhaps most crucially, thanks to all these added features, the new strain will infect even patched Windows PCs, including those with Windows 10, as one IT professional <a href="http://colsec.blogspot.co.uk/2017/06/petya-outbreak-june-27th.html" target="_blank" rel="noopener noreferrer">noted</a> in a blog, whereas WannaCry worked largely on older systems.
A Microsoft spokesperson said the company was aware of the reports and was investigating, adding: &#8220;Our initial analysis found that the ransomware uses multiple techniques to spread, including one which was addressed by a security update previously provided for all platforms from Windows XP to Windows 10 [the EternalBlue vulnerability <a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" target="_blank" rel="noopener noreferrer">MS17-010</a>]. As ransomware also typically spreads via email, customers should exercise caution when opening unknown files. We are continuing to investigate and will take appropriate action to protect customers.&#8221; It also claimed its anti-malware product, Windows Defender, detected and blocked the malware.
<h3>Pro ransomware</h3>
This latest attack appears to be the work of a professional group, unlike WannaCry, which was full of bugs and had a killswitch. which a British security researcher accessed and turned off (though more infections occurred just last week). There is no obvious killswitch with NotPetya, which Kaspersky <a href="https://twitter.com/kaspersky/status/879749175570817024/photo/1" target="_blank" rel="noopener noreferrer">said</a> has infected at least 2,000 organizations across the globe, including Ukraine, Russia, the U.K. and the United States.
NotPetya&#8217;s professionalism might come from Petya&#8217;s birth in the bustling, highly technical cybercriminal underground. Jakub Kroustek, Threat Lab Team lead at Avast, said: &#8220;One of the perfidious characteristics of Petya ransomware is that its creators offer it on the darknet with an affiliate model which gives distributors a share of up to 85% of the paid ransom amount, while 15% is kept by the malware authors.&#8221; This kind of &#8220;ransomware-as-a-service&#8221; has been a growing concern of late, given it opens up the crime to a non-technical audience.
Whatever the class of criminal behind today&#8217;s outbreak, they&#8217;ve had a good pay day, though not an astounding one. At the time of publication, 22 payments had been made to 2.39818893 Bitcoin, worth around $5,515.
Anyone even considering paying hackers to unlock their computers should reverse course, however: the email account set up to provide keys has been <a href="https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomware-email-account-in-question-already-blocked-since-midday" target="_blank" rel="noopener noreferrer">shut down</a> by the provider, Posteo. Thanks to that, there&#8217;s no obvious way of recovering files without backups. &#8211; Written by <a class="link preload-hidden ng-binding" href="http://www.forbes.com/sites/thomasbrewster/" target="_blank" rel="noopener noreferrer">Thomas Fox-Brewster</a>, FORBES STAFF

Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry

For years, security experts warned Africa&#8217;s slumbering companies of cyberattacks. On May 12, many woke up. On this day cyberattacks struck 150 countries,  infecting more than 200,000 computers and holding multi-billion-dollar businesses, like France’s Renault, Britain&#8217;s National Health Service, Spain&#8217;s Telefónica, the United States’ FedEx and Germany’s Deutsche Bahn, to ransom.
<a href="https://www.forbesafrica.com/technology/2017/06/28/petya-notpetya-latest-ransomware-deadlier-wannacry/" target="_blank" rel="noopener noreferrer">Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry</a>
Behind it is <a href="https://www.forbes.com/forbes/welcome/?toURL=https://www.forbes.com/sites/peterlyon/2017/06/22/cyber-attack-at-honda-stops-production-after-wannacry-worm-strikes/&amp;refURL=https://www.google.co.za/&amp;referrer=https://www.google.co.za/" target="_blank" rel="noopener noreferrer">WannaCry</a>. This malicious software (malware) encrypts your computer files until a ransom of $300 is paid in the virtual currency, bitcoins. In simple words, it spreads like worms in a bag of rotten apples.
Experts say the reason why this malware squirmed easily into so many companies is that they see cybersecurity as a joke. Many hadn&#8217;t updated their security in over two months.
This made it easy for hackers to exploit Microsoft Windows XP operating systems by bypassing security checks. Once into the core, the malware can search for other files to exploit.
&#8220;Africa, in fact the whole world, is woefully unprepared. Traditional security measures aren’t keeping up with the emerging threats. And it’s becoming increasingly difficult, economically, to keep throwing money at the problem, when [top level management] doesn’t necessarily understand the difference between defending against attackers versus defending against auditors, all the while, tightening the purse strings and treating security as a grudge purchase or necessary evil,&#8221; says Tim Morty, Cyber Security Specialist at Information Security Architects (ISA).
<a href="http://www.forbesafrica.com/technology/2012/02/01/web-vigilantes/" target="_blank" rel="noopener noreferrer">Web Vigilantes</a>
When your computer is under attack, Morty is the kind of guy you want at you back. For 10 years he has battled cyberattacks on the frontline in Africa, from Botswana and Namibia to Mauritius, Tanzania, Uganda and South Africa.
&#8220;Until not too long ago, the prevalent opinion was that only the big corporate and financial institutions had a need to protect their data against corporate espionage, which many considered the main external threat over and above the usual defences against spam and malware. That has changed in recent times. Cybercriminals have not only expanded their reach, they have also found a ready market in our personal data,&#8221; says Morty.
Often it can be your employees and their cell phones that make you vulnerable.
&#8220;Careless posting on social media is a major concern, as is the use of corporate resources on non-corporate networks. Let’s face it, we all love free WiFi! However, do you really know who is behind the connection, and what are they doing with the information that you are transmitting or receiving?&#8221;
One reason why Africa is so vulnerable is many of its people are still learning how the internet works.
&#8220;We need to begin learning how to survive in the virtual worlds we have created. Cybercriminals have rapidly adapted to the virtual world and are using the advantages they have developed to thrive, while others are still taking their first tentative steps in this new frontier.&#8221;
It was not long ago that businesses, according to <a href="https://home.kpmg.com/xx/en/home/campaigns/2016/06/ceo-outlook.html" target="_blank" rel="noopener noreferrer">KPMG&#8217;s 2016 Global CEO Outlook</a> study, considered cybersecurity as an afterthought. The study found cybersecurity has become a major concern for many CEOs. One in five business leaders now list information security as the risk they are most concerned about, while a third sees cybersecurity as the issue with the biggest impact on their company.
<a href="https://www.forbesafrica.com/focus/2016/03/01/making-millions-paranoia/" target="_blank" rel="noopener noreferrer">Making Millions From Paranoia</a>
The study is made from the views of nearly 1,300 CEOs from companies across 11 industries in 10 countries. Cyberattacks loom larger in Africa when many businesses are on the cusp of the Fourth Industrial Revolution, the age of machine learning, cognitive computing and artificial intelligence, play over the internet.
&#8220;Cyberattack is like cancer, there is not one form of cancer and cybersecurity has a lot of different areas. It&#8217;s one thing for somebody to steal your Mastercard and cause you aggravation, but stealing a vaccine for something like a virus, could be worth billions,&#8221; says J. Patrick Michaels Jr, the founder at Communications Equity Associates (CEA).
Michaels founded CEA in 1973 as a US Cable TV brokerage firm.  Nearly half a century later, it has investments of $1.3 billion in private equity wealth across 60 countries.
Known as a globetrotting investment banker, Michaels learned of cybersecurity in his days as Vice Chairman of the Board of Visitors of the U.S. Naval Academy. Michaels believes small businesses in Africa are prime targets for cyber blackmail.
&#8220;Hackers are starting to target the smaller companies to freeze up their businesses. A lion isn&#8217;t going to attack an elephant, when maybe a water buffalo or springbok is easier prey,&#8221; says Michaels.
&#8220;If you hijack the IT systems for a corporation, the impact on that company&#8217;s shares would be crippling. We could be sitting in Prague, sending a message to this company that to unfreeze their systems, the payment of $100 million to various bank accounts around the world would be appropriate. $100 million would be nothing compared to how much they would lose on the JSE stock markets if they were shut down for just 10 minutes.&#8221;
<a href="https://www.forbesafrica.com/focus/2013/09/01/industrial-thief-line-can-rob/" target="_blank" rel="noopener noreferrer">Industrial Thief On The Line, How Can I Rob You?</a>
On the ground in Africa, Morty warns cyberattacks are on the rise because businesses can’t foot the bill.
&#8220;South Africa is, on average, ahead of the curve, in terms of Africa, although we’ve still got a lot of room for improvement… Economically, it is sometimes prohibitively expensive to keep up with the latest and greatest technologies. For those that can afford it, the next challenge is staff upskilling and, often, retention, in a market where skilled individuals are always sought after,&#8221; says Morty.
&#8220;There have been a few occasions when we have documented some major security concerns while working with a client; from open wireless access points and often basic networking flaws at one financial institution to simple lack of visibility and understanding of the client’s environment, with the security role being taken care of by networking staff with minimal training or understanding of the technologies in use.&#8221;
External threats are only part of the problem. Disgruntled employees or moles find it easy to expose weaknesses from within.
&#8220;The typical image, often conjured by media, of hooded figures hunched ominously over a laptop keyboard, is quite misleading. Threats from within are a reality; sometimes with intent, sometimes through neglect, often by accident, especially due to poor user education about a topic that isn’t always user friendly,&#8221; says Morty.
&#8220;Rapid adoption of social media has contributed to security woes, as its users willingly provide attackers with a wealth of information to use against both organizations and individuals alike, making reconnaissance, planning and execution of social engineering attacks that much easier.&#8221;
According to the 2017 Harvey Nash/KPMG CIO Survey, the world’s largest survey of IT leadership, cybersecurity vulnerability is at an all-time high, with a third of IT leaders (32%) reporting their organization had been subject to a major cyberattack in the past 24 months – a 45% increase on 2013.
Only one in five say they are very well prepared to respond to these attacks, down from 29% in 2014. Despite very visible headline-grabbing attacks, such as the recent WannaCry ransomware attack, the biggest jump in threats comes from insider attacks, increasing from 40% to 47% over the last year.
So should we be spending millions on encrypting our phones and protecting computers from hackers?
&#8220;Oddly enough, I’m inclined to say no. Throwing money at the problem will only help up to a point. What we need to do is change the way we work. Educate our users about what it means to be part of the connected world; illustrate what the risks are as well as what can be done to protect themselves, and teach good security practices rather than dictate an intimidating list of do’s and don’ts,&#8221; says Morty.
It will take a while yet for online security to become second nature. Until then Africa&#8217;s blind spot could be expensive.
Relentless rise of organizations being subject to major cyberattacks during past four years:
2017: 32%
2016: 28%
2015: 25%
2014: 22%
Source: <a href="https://www.hnkpmgciosurvey.com/" target="_blank" rel="noopener noreferrer">The 2017 Harvey Nash/KPMG CIO Survey</a>

Tag: malware

FORBES AFRICA SOCIAL MEDIA

Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry

Mayday! Mayday! I’ve Been Hacked