World Cyber War I?

This is by far the most important news story of the day, but it seems to have been buried beneath an avalanche of James Comey coverage: Dozens of countries hit by huge cyberextortion attack:

Dozens of countries were hit with a huge cyberextortion attack Friday that locked up computers and held users’ files for ransom at a multitude of hospitals, companies and government agencies.

It was believed to the biggest attack of its kind ever recorded.

The malicious software behind the onslaught appeared to exploit a vulnerability in Microsoft Windows that was supposedly identified by the National Security Agency for its own intelligence-gathering purposes and was later leaked to the internet.

I believe a criminal gang called Shadow Brokers stole and leaked NSA documents that identified a security flaw in Microsoft software. As I understand it, the vast international attack that is occurring now exploits the security flaw identified in the leaked NSA files.

Britain’s national health service fell victim, its hospitals forced to close wards and emergency rooms and turn away patients. Russia appeared to be the hardest hit, according to security experts, with the country’s Interior Ministry confirming it was struck.

All told, several cybersecurity firms said they had identified the malicious software in upward of 60 countries, including the United States, though its effects in the U.S. did not appear to be widespread, at least in the initial hours.

Can you imagine if Russia hadn’t been hit? The whole thing would have been Trump’s fault, somehow.

Computers were infected with what is known as “ransomware” — software that freezes up a machine and flashes a message demanding payment to release the user’s data.
***
Security experts said the attack appeared to be caused by a self-replicating piece of software that enters companies and organizations when employees click on email attachments, then spreads quickly internally from computer to computer when employees share documents and other files.

Its ransom demands start at $300 and increase after two hours to $400, $500 and then $600, said Kurt Baumgartner, a security researcher at Kaspersky Lab.

The world-wide attack apparently is the work of a criminal gang. I don’t understand how they can collect the many small ransom payments they evidently are demanding without getting caught. Doesn’t there need to be a bank in the picture somewhere? But the criminals no doubt have figured this out better than I have.

By Kaspersky Lab’s count, the malware struck at least 74 countries. In addition to Russia, the biggest targets appeared to be Ukraine and India….

Hospitals across Britain found themselves without access to their computers or phone systems. Many canceled all routine procedures and asked patients not to come to the hospital unless it was an emergency. Doctors’ practices and pharmacies reported similar problems.

Patrick Ward, a 47-year-old sales director, said his heart operation, scheduled for Friday, was canceled at St. Bartholomew’s Hospital in London.

Tom Griffiths, who was at the hospital for chemotherapy, said several cancer patients had to be sent home because their records or bloodwork couldn’t be accessed.

“Both staff and patients were frankly pretty appalled that somebody, whoever they are, for commercial gain or otherwise, would attack a health care organization,” he said.

Anyone surprised by this hasn’t been paying attention for a long time.

But today’s attack was only intended, apparently, to extract ransom. Equally talented hackers could bring down hospitals, government agencies and corporations without making any demands, simply to cripple a given country or region. Such cyber warfare has been feared for a long time. It looks like it finally has become a reality.

Notice: All comments are subject to moderation. Our comments are intended to be a forum for civil discourse bearing on the subject under discussion. Commenters who stray beyond the bounds of civility or employ what we deem gratuitous vulgarity in a comment — including, but not limited to, “s***,” “f***,” “a*******,” or one of their many variants — will be banned without further notice in the sole discretion of the site moderator.

Responses