China pledges neutrality unless US strikes North Korea first

China’s government says it would remain neutral if North Korea attacks the United States, but warned it would defend its Asian neighbor if the U.S. strikes first and tries to overthrow Kim Jong Un’s regime, Chinese state media said Friday.

“If the U.S. and South Korea carry out strikes and try to overthrow the North Korean regime, and change the political pattern of the Korean Peninsula, China will prevent them from doing so,” reported the Global Times, a daily Chinese newspaper controlled by the Communist Party.

Meanwhile, other Asia-Pacific countries have come out in support of the United States in the event of a North Korean nuclear attack.

Japan’s defense minister, Itsunori Onodera, said this week that his nation’s military was ready to shoot down North Korean nuclear missiles, if necessary.

In Australia, Prime Minister Malcolm Turnbull described his country and the U.S. as being “joined at the hip,” the South China Morning Post reported.

“If there is an attack on the U.S., the Anzus Treaty would be invoked,” and Australia would aid the U.S., Turnbull told Australia’s 3AW radio Friday morning. Turnbull was referring to a collective security agreement between the United States, Australia and New Zealand.

The Chinese response to the heightened tensions between the U.S. and North Korea followed a number of hot-headed proclamations.

North Korea has threatened the U.S. with a nuclear attack on Guam, a U.S. territory south of Japan, after President Donald Trump said additional threats against the country or its allies would be met with “fire and fury.”

On Thursday, the president doubled-down on the remarks, saying his original comment possibly “wasn’t tough enough.”

In a separate appearance, Trump added: “Let’s see what [Kim Jong Un] does with Guam. He does something in Guam, it will be an event the likes of which nobody has seen before – what will happen in North Korea.”

One North Korean government official, meanwhile, accused Trump of “going senile,” Fox News reported.

Read More >>

Read More

Donald Trump prepares supporters for worst as Robert Mueller's Russia investigation closes in

Embattled President tells fanbase election hacking conspiracy an establishment fabrication invented to deprive them of their leader of choice

President Donald Trump is again attacking the media on Monday, and his broadsides carry a newly ominous edge: He is both faulting the media for allegedly downplaying the size and intensity of support from his base and accusing them of trying to deliberately weaken that support for him.

7 Aug
Donald J. Trump  ✔ @realDonaldTrump
The Trump base is far bigger & stronger than ever before (despite some phony Fake News polling). Look at rallies in Penn, Iowa, Ohio.......

Donald J. Trump ✔ @realDonaldTrump
Hard to believe that with 24/7 #Fake News on CNN, ABC, NBC, CBS, NYTIMES & WAPO, the Trump base is getting stronger!
7:18 AM - Aug 7, 2017
 25,742 25,742 Replies   16,584 16,584 Retweets   69,173 69,173 likes

This comes some 24 hours after Deputy Attorney General Rod J. Rosenstein made big news by telling Fox News Sunday that if the special counsel finds evidence of crimes in the course of his probe into Russian sabotage of our election, it may be within the scope of his investigation to pursue them.

In these seemingly disparate developments, it is hard not to discern the potential for a volatile, combustible combination.

Because Trump is undermining our democratic norms and processes in so many ways, it is often easy to focus on each of them in isolation, rather than as part of the same larger story. But, taken together, they point to a possible climax in which Trump, cornered by revelations unearthed by Robert S. Mueller III's probe and by ongoing media scrutiny, seeks to rally his supporters behind the idea that this outcome represents not the imposition of accountability by functioning civic institutions, but rather an effort to steal the election from him - and from them.

On ABC's This Week, Trump counsellor Kellyanne Conway on Sunday dismissed the “entire Russia investigation” as a “total fabrication” to “excuse” Hillary Clinton's loss. This echoed Trump himself, who recently told a rally that the probe is an effort to “cheat” his supporters out of their legitimately elected leadership (i.e., him) with a “fake story” that is “demeaning to our country and demeaning to our Constitution.”

It bears repeating that Mueller's investigation is looking at how a hostile foreign power may have sabotaged our democracy, and at whether the Trump campaign colluded with it, and at conduct by Trump himself that came after the election: Whether the firing of former FBI Director James Comey after a demand for his loyalty was part of a pattern of obstruction of justice. The first of these has been attested to by our intelligence services, and evidence of the second (at least in the form of a willingness to collude) and the third of these has been unearthed by dogged scrutiny by news outlets. It is hardly an accident that Trump continues to cast doubt on the credibility of both those institutions, even as he and his spokespeople continue to cast the entire affair as an effort to reverse the election by illegitimate means.

This threatens damage on multiple levels. By casting the entire Russia story as fiction, Trump seeks to undermine the credibility of efforts to determine how our electoral system might be vulnerable to further attacks, separate and irrespective of what is learned about the Trump campaign's conduct, possibly making it less likely that we secure our system against any such future sabotage.

We don't know what all the ongoing scrutiny will produce in the way of revelations. But if it does produce any serious wrongdoing by Trump and/or his campaign - or even evidence of serious misconduct that is not criminal - it's not difficult to imagine what might happen next. Trump's advisers regularly tell us he will cooperate with Mueller's probe and play down the possibility of any effort to remove the special counsel. But Trump has confirmed that he is furious with his own attorney general, Jeff Sessions, for failing to protect him from Mueller's probe. That Trump confirmed this publicly only further underscores that he has zero sense of any obligation to the public to follow any rules of conduct, and plainly views any efforts to hold him accountable to those rules as illegitimate.

Conservative writer Matt Lewis floats a scenario in which Mueller, under pressure to produce results, slips into prosecutorial overreach, giving Trump voters legitimate reasons to feel that the presidency is being stolen from them. It is fair to worry about such an outcome, and we must remember that we are far from knowing the full truth about what happened in 2016. But it's also easy to envision the flip side: Trump demagoguing his supporters into a frenzy of rage, at rallies that are exactly like the ones we've seen in recent days, in the face of legitimate revelations.

To be sure, there are new signs that Republicans in Congress are taking steps to set up safeguards, should Trump try to remove Mueller. There is reassuring evidence that our institutions are holding - for now, anyway - and as Brian Beutler notes in The New Republic, it's likely that more future revelations about Trump's unfitness for the presidency will further undercut his efforts to cast institutions holding him accountable as illegitimate. But Trump is already giving every indication that he will go all out in trying. And how much damage that will cause is anyone's guess.

Read More >>

Read More

No more ransomware: How one website is stopping the crypto-locking crooks in their tracks

No More Ransom launched a year ago: here's the story of how cybersecurity firms and law enforcement are working together to bring down ransomware.

Law enforcement organisations and cybersecurity companies around the world have attempted to do what they can to disrupt ransomware -- whether through takedowns of cybercriminal gangs by the authorities or security companies finding and providing decryption keys.
But this disjointed approach can only get so far in the modern hyper-connected world in which criminals cooperate across international borders and time zones.

It's why the No More Ransom initiative was launched a year ago, with the idea of bringing together law enforcement and private industry to combine efforts in the fight against cybercrime.
"It's the idea of everyone bringing what they're best at to the table to jointly try and tackle the biggest threat that we see out there," says Steve Wilson, head of Europol's Cybercrime Centre (EC3).

Launched jointly by Europol, the Dutch National Police, McAfee (then Intel Security), and Kaspersky Lab on July 25 2016, No More Ransom provided keys to unlocking encrypted files, as well as information on how to avoid succumbing to ransomware in the first place.

The portal initially provided decryption tools for four ransomware families: Shade, Rannoh, Rakhn, and CoinVault. It was collaborative work on decrypting CoinVault that led to the creation of a precursor to No More Ransom.
"We were working on CoinVault and did a lot of work with the Dutch police, and we were able to identify the command and control servers the cybercriminals were using," says David Emm, principal security researcher, Kaspersky Lab.

The operation led to Kaspersky uploading free-to-use decryption keys to a website and it took off from there. "It was really successful and this was just one and part of a wider trend, so we wanted to establish wider involvement," he says.

McAfee agreed that this collaboration -- both between competing private firms and the authorities -- was the way forward in the fight against the escalation of ransomware.

"There was just a sense that what would be nice would be to have an initiative to collaborate and work together on. But also to have a single point that people could go to when we create free decryption tools," says Raj Samani, chief scientist at McAfee.

That single place was the No More Ransom portal, which since its launch has been hosted by Amazon Web Services and Barracuda Networks -- and if it wasn't for cloud-hosting, the website would have been overwhelmed on its first day.

"Part of my responsibility was to find a hosting provider and I remember at the time I was asked how many HTTPs requests do you think you'll get a day and I thought 12,000 a day would be reasonable," says Samani.

"On day one we had 2.7 million -- then during one day, the weekend of WannaCry, we had eight million hits in a single day, so it's much bigger than we ever thought."

Following the initial success of the initiative, seven more cybersecurity firms have since joined as associate partners -- Bitdefender, Check Point, Trend Micro, Emisoft, ElevenPaths, Avast and Cert.PL -- each contributing to the development of decryption keys.

Dozens of law enforcement agencies -- including Interpol, Enisa and the NCA -- have also become actively involved in the scheme, which also receives additional support from dozens of security firms. There's now 109 partners in total and for Wilson, the more involved, the merrier: "The more people we get to contribute, the better this resource is going to be," he says.

Cybercrime is a global problem, but while there is more international cooperation between law enforcement agencies than there's been before, rules and regulations mean that sometimes the authorities can't act as quickly as they'd like.

That's a disadvantage against global crime gangs, but private cybersecurity firms can be more flexible, enabling the No More Ransom operation to take the fight to cybercriminals at a faster pace by releasing decryption tools as and when they're developed.

"Law enforcement agencies have restrictions that criminals don't -- they have the logistics of paperwork. Whereas at least under the umbrella of a project like this, there's nothing to slow it down," says Emm.

It's difficult to quantify the exact number of decryptions which have occurred thanks to downloads from No More Ransom -- the portal just provides links, it doesn't monitor what happens next -- but it's thought that over 28,000 decryptions have taken place using the tools, saving millions from being paid to cybercriminals in the process.

"It really strongly justified a single response to this rather than over each country trying to develop something themselves," says EC3's Wilson.

No More Ransom doesn't discriminate about what decryption tools are added to the portal -- sometimes these come in batches, sometimes individual decryptors are uploaded as and when they're made available -- but how does this happen?

There are a number of ways. The first is if encryption keys simply get leaked. Indeed, an example of this occurred just hours after the launch of No More Ransom when the cybercriminal gang behind the Petya ransomware -- long before it caused a global incident -- leaked 3,500 decryption keys for a competing form of ransomware, Chimera. "We were able to grab them and create a tool," says Samani.

But most of the time, decrypting ransomware comes down to hard work, with cybersecurity firms and the authorities working together in order to identify ransomware variants and crack codes.

"Working with law enforcement, we identify the infrastructure, go through the proper legal process to seize the key server and extract the decryption keys," says Samani. That's how Shade ransomware was decrypted, resulting in 165,000 decryption keys being made available.

That's where the aid of law enforcement especially comes in -- a cybersecurity firm can't walk in and seize a botnet, but they can aid in its takedown, as was the case with Operation Avalanche, which took down a prominent malware botnet.

"On the offensive side from us, tackling the actual business model of ransomware-as-a-service and very much going after the large scale perpetrators of cybercrime is very much what we're trying to do," says Wilson.

Naturally, the very existence of No More Ransom has irked malicious actors. "Analysis of the chatter on underground forums shows how angry they are," says McAfee's Samani. "We even had a ransomware variant named after us -- there's an extension that had been encrypted as NoMoreRansom."

So the portal is required to have the best defences possible in order to prevent attacks against it.

"We've got to do all the normal housekeeping things to keep it secure. We've got to pen test it to ensure that it's as secure as we can make it. People are going to want to stop it, we need to make it as resilient as we can," says David Emm.

That's where Barracuda Networks and Amazon Web Services come in -- both powering the portal and keeping it safe from attackers -- in the spirit of cooperation on which No More Ransom is based.

"I'm blown away by how open and collaborative we've been. AWS, for example, hosting it for free, it's incredible, it's probably the most targeted website in the world and they've said OK, no arguments," says Samani.

A year on from the launch of No More Ransom, what's the project's future? An anniversary update includes more decryption tools and the website translated into even more languages to reflect the global interest in the project and to help users and businesses around the world.

The platform is now available in 26 languages, with the most recent additions Bulgarian, Chinese, Czech, Greek, Hungarian, Indonesian, Malay, Norwegian, Romanian, Swedish, Tamil and Thai.

Ransomware is a major problem and while no one is under any illusion that the project is going to eliminate the problem, those behind it are doing all they can to educate against the dangers of ransomware and provide aid against it.

"We totally accept that this isn't a panacea; there's always going to be a lag time between us being able to assist, but we're trying to make that difference," says Wilson.

That's no small task, given ransomware is ever-evolving - and things are likely to get worse before they get better.

Read More >>

Read More

The Petya ransomware is starting to look like a cyberattack in disguise

The ransomware that wasn’t

The haze of yesterday’s massive ransomware attack is clearing, and Ukraine has already emerged as the epicenter of the damage. Kaspersky Labs reports that as many as 60 percent of the systems infected by the Petya ransomware were located within Ukraine, far more than anywhere else. The hack’s reach touched some of the country’s most crucial infrastructure including its central bank, airport, metro transport, and even the Chernobyl power plant, which was forced to move radiation-sensing systems to manual.

The ostensible purpose of all that damage was to make money — and yet there’s very little money to be found. Most ransomware flies under the radar, quietly collecting payouts from companies eager to get their data back and decrypting systems as payments come in. But Petya seems to have been incapable of decrypting infected machines, and its payout method was bizarrely complex, hinging on a single email address that was shut down almost as soon as the malware made headlines. As of this morning, the Bitcoin wallet associated with the attack had received just $10,000, a relatively meager payout by ransomware standards.

“THERE’S NO FUCKING WAY THIS WAS CRIMINALS.”
It leads to an uncomfortable question: what if money wasn’t the point? What if the attackers just wanted to cause damage to Ukraine? It’s not the first time the country has come under cyberattack. (These attacks have typically been attributed to Russia.) But it would be the first time such an attack has come in the guise of ransomware, and has spilled over so heavily onto other countries and corporations.

Because the virus has proven unusually destructive in Ukraine, a number of researchers have come to suspect more sinister motives at work. Peeling apart the program’s decryption failure in a post today, Comae’s Matthieu Suiche concluded a nation state attack was the only plausible explanation. “Pretending to be a ransomware while being in fact a nation state attack,” Suiche wrote, “ is in our opinion a very subtle way from the attacker to control the narrative of the attack.”

Another prominent infosec figure put it more bluntly: “There’s no fucking way this was criminals.”


There’s already mounting evidence that Petya’s focus on Ukraine was deliberate. The Petya virus is very good at moving within networks, but initial attacks were limited to just a few specific infections, all of which seem to have been targeted at Ukraine. The highest-profile one was a Ukrainian accounting program called MeDoc, which sent out a suspicious software update Tuesday morning that many researchers blame for the initial Petya infections. Attackers also planted malware on the homepage of a prominent Ukraine-based news outlet, according to one researcher at Kaspersky.

THE INFECTIONS SEEM TO TARGET UKRAINE’S MOST VITAL INSTITUTIONS
In each case, the infections seem to specifically target Ukraine’s most vital institutions, rather than making a broader attempt to find lucrative ransomware targets. These initial infections are particularly telling because they were directly chosen by whoever set the malware in motion. Computer viruses often spread farther than their creators intended, but once Petya was on the loose, the attackers would have had no control over how far it reached. But the attackers had complete control over where they planted Petya initially, and they chose to plant it by some of the most central institutions in Ukraine.

The broader political context makes Russia a viable suspect. Russia has been engaged in active military interventions in Ukraine since former president Viktor Yanukovych was removed from power in 2014. That has included the annexation of Crimea and the active movement of troops and equipment in the eastern region of the country, but also a number of more subtle activities. Ukraine’s power grid came under cyberattack in December 2015, an attack many interpreted as part of a hybrid attack by Russia against the country’s infrastructure. That hybrid-warfare theory extends to more conventional guerrilla attacks: the same day that Petya ripped through online infrastructure, Ukrainian colonel Maksim Shapoval was killed by a car bomb attack in Kiev.

“I THINK ULTIMATELY IT’S ABOUT MONEY.”
All that evidence is still circumstantial, and there’s no hard link between yesterday’s attacks and any nation state. It could be Ukraine simply presented a soft target, and the attackers screwed up their payment and decryption systems out of simple carelessness. Functional or not, the software involved still has strong ties to traditional ransomware systems, and even if the attackers didn’t make much money off ransom payments, Petya was still collecting credentials and other data from infected machines, which could be valuable fodder for future attacks. That has led researchers like F-Secure’s Sean Sullivan to hold off on nation-state suspicions. “Maybe there’s multiple ways they’re working the money angle, but I think ultimately it’s about money,” Sullivan told me. “Tigers don’t change their stripes.”

Still, the line between common criminals and state agents can be difficult to parse. A recent indictment in the Yahoo hacking case charged Russian officials alongside freelance hackers, and the division of labor was often unclear. Criminals can be enlisted as privateers, or agents can adopt criminal tactics as a way of disguising themselves. If the suspicions around Petya are correct, that line may be growing even thinner, as globe-spanning attacks get lost in the fog of war. With no clear path to a firm attribution, we may never be able to prove who was responsible for this week’s attacks, or what they hoped to achieve. For anyone digging out a Petya-bricked computer system, that clean getaway is adding insult to injury.The haze of yesterday’s massive ransomware attack is clearing, and Ukraine has already emerged as the epicenter of the damage. Kaspersky Labs reports that as many as 60 percent of the systems infected by the Petya ransomware were located within Ukraine, far more than anywhere else. The hack’s reach touched some of the country’s most crucial infrastructure including its central bank, airport, metro transport, and even the Chernobyl power plant, which was forced to move radiation-sensing systems to manual.

The ostensible purpose of all that damage was to make money — and yet there’s very little money to be found. Most ransomware flies under the radar, quietly collecting payouts from companies eager to get their data back and decrypting systems as payments come in. But Petya seems to have been incapable of decrypting infected machines, and its payout method was bizarrely complex, hinging on a single email address that was shut down almost as soon as the malware made headlines. As of this morning, the Bitcoin wallet associated with the attack had received just $10,000, a relatively meager payout by ransomware standards.

“THERE’S NO FUCKING WAY THIS WAS CRIMINALS.”
It leads to an uncomfortable question: what if money wasn’t the point? What if the attackers just wanted to cause damage to Ukraine? It’s not the first time the country has come under cyberattack. (These attacks have typically been attributed to Russia.) But it would be the first time such an attack has come in the guise of ransomware, and has spilled over so heavily onto other countries and corporations.

Because the virus has proven unusually destructive in Ukraine, a number of researchers have come to suspect more sinister motives at work. Peeling apart the program’s decryption failure in a post today, Comae’s Matthieu Suiche concluded a nation state attack was the only plausible explanation. “Pretending to be a ransomware while being in fact a nation state attack,” Suiche wrote, “ is in our opinion a very subtle way from the attacker to control the narrative of the attack.”

Another prominent infosec figure put it more bluntly: “There’s no fucking way this was criminals.”


There’s already mounting evidence that Petya’s focus on Ukraine was deliberate. The Petya virus is very good at moving within networks, but initial attacks were limited to just a few specific infections, all of which seem to have been targeted at Ukraine. The highest-profile one was a Ukrainian accounting program called MeDoc, which sent out a suspicious software update Tuesday morning that many researchers blame for the initial Petya infections. Attackers also planted malware on the homepage of a prominent Ukraine-based news outlet, according to one researcher at Kaspersky.

THE INFECTIONS SEEM TO TARGET UKRAINE’S MOST VITAL INSTITUTIONS
In each case, the infections seem to specifically target Ukraine’s most vital institutions, rather than making a broader attempt to find lucrative ransomware targets. These initial infections are particularly telling because they were directly chosen by whoever set the malware in motion. Computer viruses often spread farther than their creators intended, but once Petya was on the loose, the attackers would have had no control over how far it reached. But the attackers had complete control over where they planted Petya initially, and they chose to plant it by some of the most central institutions in Ukraine.

The broader political context makes Russia a viable suspect. Russia has been engaged in active military interventions in Ukraine since former president Viktor Yanukovych was removed from power in 2014. That has included the annexation of Crimea and the active movement of troops and equipment in the eastern region of the country, but also a number of more subtle activities. Ukraine’s power grid came under cyberattack in December 2015, an attack many interpreted as part of a hybrid attack by Russia against the country’s infrastructure. That hybrid-warfare theory extends to more conventional guerrilla attacks: the same day that Petya ripped through online infrastructure, Ukrainian colonel Maksim Shapoval was killed by a car bomb attack in Kiev.

“I THINK ULTIMATELY IT’S ABOUT MONEY.”
All that evidence is still circumstantial, and there’s no hard link between yesterday’s attacks and any nation state. It could be Ukraine simply presented a soft target, and the attackers screwed up their payment and decryption systems out of simple carelessness. Functional or not, the software involved still has strong ties to traditional ransomware systems, and even if the attackers didn’t make much money off ransom payments, Petya was still collecting credentials and other data from infected machines, which could be valuable fodder for future attacks. That has led researchers like F-Secure’s Sean Sullivan to hold off on nation-state suspicions. “Maybe there’s multiple ways they’re working the money angle, but I think ultimately it’s about money,” Sullivan told me. “Tigers don’t change their stripes.”


Still, the line between common criminals and state agents can be difficult to parse. A recent indictment in the Yahoo hacking case charged Russian officials alongside freelance hackers, and the division of labor was often unclear. Criminals can be enlisted as privateers, or agents can adopt criminal tactics as a way of disguising themselves. If the suspicions around Petya are correct, that line may be growing even thinner, as globe-spanning attacks get lost in the fog of war. With no clear path to a firm attribution, we may never be able to prove who was responsible for this week’s attacks, or what they hoped to achieve. For anyone digging out a Petya-bricked computer system, that clean getaway is adding insult to injury.

Read More >>

Read More

Cyberattack Hits Ukraine Then Spreads Internationally

Several companies have been affected by the Petya cyberattack, including, from left, Rosneft, the Russian energy giant; Merck, a pharmaceutical company; and Maersk, a shipping company. Credit Left, Sergei Karpukhin/Reuters; center, Matt Rourke/Associated Press; right, Enrique Castro Sanchez/Agence France-Presse — Getty Images

Computer systems from Ukraine to the United States were struck on Tuesday in an international cyberattack that was like a recent assault that crippled tens of thousands of machines worldwide.

In Kiev, the capital of Ukraine, A.T.M.s stopped working. About 80 miles away, workers were forced to manually monitor radiation at the old Chernobyl nuclear plant when their computers failed. And tech managers at companies around the world, from Maersk, the Danish shipping conglomerate, to Merck, the drug giant in the United States, were scrambling to respond.

It was unclear who was behind this cyberattack, and the extent of its impact was still hard to gauge Tuesday. It started as an attack on Ukrainian government and business computer systems — an assault that appeared to have been intended to hit the day before a holiday marking the adoption in 1996 of Ukraine’s first Constitution after breaking away from the Soviet Union. It spread from there, causing collateral damage around the world.

This outbreak is the latest and perhaps the most sophisticated in a series of attacks that make use of dozens of hacking tools that were stolen from the National Security Agency and leaked online in April by a group called the Shadow Brokers.

Like the WannaCry attacks in May, the latest global hacking took control of computers and demanded digital ransom from their owners to regain access. The new attack used the same N.S.A. hacking tool, Eternal Blue, that was used in the WannaCry incident, and two other methods to promote its spread, according to researchers at the computer security company Symantec.

The N.S.A. has not acknowledged its tools were used in WannaCry or other attacks. But computer security specialists are demanding that the agency help the rest of the world defend against the weapons it created.

”The N.S.A. needs to take a leadership role in working closely with security and operating system platform vendors such as Apple and Microsoft to address the plague that they’ve unleashed,” said Golan Ben-Oni, the global chief information officer at IDT, a Newark-based conglomerate hit by a separate attack in April that used N.S.A. hacking tools. Mr. Ben-Oni warned federal officials that more serious attacks were probably on the horizon.

The vulnerability in Windows software used by Eternal Blue was patched by Microsoft in March, but as the WannaCry attacks demonstrated, hundreds of thousands of organizations around the world failed to properly install the fix.

“Just because you roll out a patch doesn’t mean it’ll be put in place quickly,” said Carl Herberger, vice president of security at Radware. “The more bureaucratic an organization is, the higher chance it won’t have updated its software.”

Because the ransomware used at least two other ways to spread on Tuesday, even those who used the Microsoft patch could be vulnerable, according to researchers at F-Secure, the Finnish cybersecurity firm.

A Microsoft spokesman said the company’s latest antivirus software should protect against the attack.

The Ukrainian government said several of its ministries, local banks and metro systems had been affected. A number of other European companies, including Rosneft, the Russian energy giant; Saint-Gobain, the French construction materials company; and WPP, the British advertising agency, also said they had been targeted.

Ukrainian officials pointed a finger at Russia on Tuesday, though Russian companies were also affected. Home Credit bank, one of Russia’s top 50 lenders, was paralyzed, with all of its offices closed, according to the RBC news website. The attack also affected Evraz, a steel manufacturing and mining company that employs about 80,000 people, the RBC website reported.

In the United States, DLA Piper, the multinational law firm, also reported being hit. Hospitals in Pennsylvania were being forced to cancel surgeries after the attack hit computers at Heritage Valley Health Systems, a Pennsylvania health care provider, and its hospitals in Beaver and Sewickley, Penn., and satellite locations across the state.

A spokesman for the N.S.A. referred questions about the attack to the Department of Homeland Security. “The Department of Homeland Security is monitoring reports of cyber attacks affecting multiple global entities and is coordinating with our international and domestic cyber partners,” Scott McConnell, spokesman for D.H.S., said in a statement.

Computer specialists said the ransomware was very similar to a virus that first emerged last year called Petya. Petya means “Little Peter,” in Russian, leading some to speculate the name referred to Sergei Prokofiev’s 1936 symphony “Peter and the Wolf,” about a boy who captures a wolf.

Reports that the computer virus was a variant of Petya suggest the attackers will be hard to trace. Petya was for sale on the so-called dark web, where its creators made the ransomware available as “ransomware as a service” — a play on Silicon Valley terminology for delivering software over the internet, according to the security firm Avast Threat Labs.

That means anyone could launch the ransomware with the click of a button, encrypt someone’s systems and demand a ransom to unlock it. If the victim pays, the authors of the Petya ransomware, who call themselves Janus Cybercrime Solutions, get a cut of the payment.

That distribution method means that pinning down the people responsible for Tuesday’s attack could be difficult.

The attack is “an improved and more lethal version of WannaCry,” according to Matthieu Suiche, a security researcher who helped contain the spread of the WannaCry ransomware when he created a kill switch that stopped the attacks.

In just the last seven days, Mr. Suiche noted that WannaCry had tried to hit an additional 80,000 organizations, but was prevented from executing attack code because of the kill switch. Petya does not have a kill switch.

A screenshot of what appeared to be the ransomware affecting systems worldwide on Tuesday. The Ukrainian government posted the shot to its official Facebook page.

Petya also encrypts and locks entire hard drives, while the earlier ransomware attacks locked only individual files, said Chris Hinkley, a researcher at Armor, the security firm.

The hackers behind Petya demanded $300 worth of the cybercurrency Bitcoin to unlock victims’ machines. By Tuesday afternoon, online records showed that 30 victims had paid the ransom, though it was not clear whether they regained access to their files. Other victims may be out of luck, after Posteo, the German email service provider, shut down the hackers’ email account.

In Ukraine, people turned up at post offices, A.T.M.s and airports to find blank computer screens, or signs about closures. At Kiev’s central post office, a few bewildered customers milled about, holding parcels and letters, looking at a sign that said, “closed for technical reasons.”

The hackers compromised Ukrainian accounting software mandated to be used in various industries in the country, including government agencies and banks, according to researchers at Cisco Talos, the security division of the computer networking company. That allowed them to unleash their ransomware when the software, which is also used in other countries, was updated.

The ransomware spread for five days across Ukraine, and around the world, before activating Tuesday evening.

“If I had to guess, I would think this was done to send a political message,” said Craig Williams, the senior technical researcher at Talos.

One Kiev resident, Tetiana Vasylieva, was forced to borrow money from a relative after failing to withdraw money at four automated teller machines. At one A.T.M. in Kiev belonging to the Ukrainian branch of the Austrian bank Raiffeisen, a message on the screen said the machine was not functioning.

Ukraine’s Infrastructure Ministry, the postal service, the national railway company, and one of the country’s largest communications companies, Ukrtelecom, had been affected, Volodymyr Omelyan, the country’s infrastructure minister, said in a Facebook post.

Officials for the metro system in Kiev said card payments could not be accepted. The national power grid company Kievenergo had to switch off all of its computers, but the situation was under control, according to the Interfax-Ukraine news agency. Metro Group, a German company that runs wholesale food stores, said its operations in Ukraine had been affected.

At the Chernobyl plant, the computers affected by the attack collected data on radiation levels and were not connected to industrial systems at the site, where, though all reactors have been decommissioned, huge volumes of radioactive waste remain. Operators said radiation monitoring was being done manually.

Cybersecurity researchers questioned whether collecting ransom was the true objective of the attack.

“It’s entirely possible that this attack could have been a smoke screen,” said Justin Harvey, the chief security officer for the Fidelis cybersecurity company. “If you are an evil doer and you wanted to cause mayhem, why wouldn’t you try to first mask it as something else?”

Read More >>

Read More

Global Cyberattack: What We Know and Don’t Know

A screenshot of what appeared to be the ransomware affecting systems worldwide on Tuesday. The Ukrainian government posted the shot to its official Facebook page.

A quickly spreading ransomware attack is hitting countries across the world including France, Russia, Spain, Ukraine and the United States, just weeks after a ransomware attack known as WannaCry.

What We Know

• Several private companies have confirmed that they were hit by the attack, including the American pharmaceutical giant Merck, the Danish shipping company AP Moller-Maersk, the British advertising firm WPP, the French multinational Saint-Gobain and the Russian steel, mining and oil companies Evraz and Rosneft.

• Photographs and videos of computers affected by the attack show a message of red text on a black screen. The message read: “Oops, your important files have been encrypted. If you see this text then your files are no longer accessible because they have been encrypted. Perhaps you are busy looking to recover your files but don’t waste your time.”

• Kaspersky Lab, a cybersecurity firm based in Moscow, reported that about 2,000 computer systems had been affected by the new ransomware.

• Cybersecurity researchers first called the new ransomware attack Petya, as it bore similarities to a ransomware strain known by that name, which was first reported by Kasperksy in March 2016. But Kaspersky later said that its investigation into the new attack found that it was a type of ransomware that had never been seen before.

• ESET, a Slovakia-based cybersecurity company, said the first known infection occurred early on June 27, through a Ukrainian software company called MeDoc. MeDoc denied that its program was the initial infection point. In a Facebook post, the firm wrote, “At the time of updating the program, the system could not be infected with the virus directly from the update file,” though an earlier message confirmed that its systems had been compromised.

• Symantec, a Silicon Valley cybersecurity firm, confirmed that the ransomware was infecting computers through at least one exploit, or vulnerability to computer systems, known as Eternal Blue.

• Eternal Blue was leaked online last April by a mysterious group of hackers known as the Shadow Brokers, who have previously released hacking tools used by the National Security Agency. That vulnerability was used in May to spread the WannaCry ransomware, which affected hundreds of thousands of computers in more than 150 countries.

• ESET and several other cybersecurity companies have identified at least one other exploit used in the attack known as PsExec, which takes advantage of a single computer that has not been updated with the latest software in a network to spread infections by looking for — and using — administrative credentials. By using PsExec, the ransomware continued spreading across systems that had been updated, or patched, after the WannaCry outbreak last month.

• Several cybersecurity researchers have identified a Bitcoin address to which the attackers are demanding a payment of $300 from their victims. At least some of the victims appear to be paying the ransom, even though the email address used by the attackers has been shut down. That removes the possibility that the attackers could restore a victim’s access to their computer networks, even once ransom is paid.

What We Don’t Know

• Who is behind the ransomware attack. The original Petya ransomware was developed and used by cybercriminals, and variations have been sold through dark web trading sites, which are accessible only by using browsers that mask a user’s identity, making it difficult for cybersecurity researchers to track.

• The motives for the attack. Cybersecurity researchers ask why, if the goal of the attack was to force victims to pay ransom, more care was not taken to protect the email address through which attackers could communicate with their victims, or to provide multiple avenues for payment.

• How much bigger this attack will get. Cybersecurity researchers say that like WannaCry, the ransomware infects computers using vulnerabilities in the central nerve of a computer, called a kernel, making it difficult for antivirus firms to detect. It also has the ability to take advantage of a single unpatched computer on a network to infect computers across a vast network, meaning that even systems that were updated after WannaCry could potentially become vulnerable again.

What Is Ransomware?

• Ransomware is one of the most popular forms of online attack today. It typically begins with attackers sending their victims email that includes a link or a file that appears innocuous but contains dangerous malware.

• Once a victim clicks on the link or opens the attachment, the computer becomes infected. The program encrypts the computer, essentially locking the user out of files, folders and drives on that computer. In some cases, the entire network the computer is connected to can become infected.

• The victim then receives a message demanding payment in exchange for attackers unlocking the system. The payment is usually requested in Bitcoin, a form of digital currency.

Read More >>

Read More