Analysis:: ‘WannaCry’ ransomware attack shows why Apple refused to hack terrorist’s iPhone
Cybersecurity researchers said a malicious program that disabled computers at Britain’s National Health Service, Russia’s Interior Ministry and companies and homes across dozens of countries Friday originated with the National Security Agency.
Earlier this year, a hacking group calling itself Shadow Brokers published online what it described as stolen NSA documents. They were filled with information that hacking experts said could be used to secretly take over and pluck data from laptops, smartphones and even smart TVs.
Friday’s attack appeared to target computers running Microsoft Windows and took advantage of a flaw in the operating system. Microsoft released a patch for the bug in March, but users who didn’t update their systems remained susceptible to having their files locked up until they made a ransom payment to attackers.
To cybersecurity experts, Friday’s incident showed exactly why technology companies such as Microsoft, Google and Apple are so defensive about the idea of backdoors into their services and devices.
Law enforcement agencies may want a way into highly secure gadgets and apps to further their investigations — such as when the FBI pressed Apple last year to hack into the iPhone used by a gunman in the San Bernardino terror attack. But the companies have repeatedly pointed out that there’s no safe way to build an entry point just for trusted government organizations.
Though the NSA hasn’t confirmed it was hacked, the purported leak of its tools shows that even supposedly secret vulnerabilities can get into the wrong hands.
“It goes back to the mafia expression,” said John Bambenek, threat research manager at Fidelis Cybersecurity. “The only way to keep a secret is for three people to know it and two of them to be dead.”
Bambenek and other researchers have called for the U.S. government to be more forthcoming with its hacking methods. Government agencies, they acknowledge, need to be able to engage in online espionage and warfare. But when flaws the agencies discover pose a threat to the nation’s businesses and consumers, they should be forced to help secure systems.
“Intelligence agencies like hoarding secrets,” Bambenek said. “But at some point, their mission isn’t hoarding secrets. It’s protecting national security. You’re rarely the first person to find [a flaw to exploit] and you’re not going to be the only one to know about it very long.”
Microsoft issued a fix for the vulnerability that hackers capitalized upon Friday before the Shadow Brokers leak occurred, which experts have speculated suggests the NSA may have tipped the company off about the impending leak. But that sort of disclosure remains rare and too narrow, Bambenek said.
“There’s a broad community beyond the software company [with the flaw] that could help protect” consumers, he said. “There was no disclosure made to us.”
In addition to homes and government agencies, Friday’s attack hit companies including delivery giant Fedex and Spain’s biggest telecom firm, Telefonica.
Researchers believe computers were infected after users opened a link in a phishing email. Bambenek said a message that was purportedly sent to workers at Telefonica carried a subject line referencing a wire transfer and asked them to check a website for more details. That link — when launched on a Windows computer suffering from the vulnerability discovered by the NSA — unleashed the WannaCry program that rendered files inaccessible.
As recently as last week, about 1.7 million computers connected to the Internet were susceptible to such an attack, said Sean Dillon, senior security analyst at security software start-up RiskSense. Even if not all of them were hit Friday, many could fall victim in the coming days to similar attacks. The supposed NSA leaks included four other infection methods.
“This obviously was a well-planned and well-coordinated attack,” Dillon said. “This probably is just the beginning.”
Nobody has claimed responsibility for carrying out the attack.
To read the article in Spanish, click here
Twitter: @peard33
ALSO
The big LAX terminal shuffle will let JetBlue create a lobby with (almost?) no lines
Amazon hopes to dominate yet another market — furniture
Wells Fargo may have created 1.4 million more unauthorized accounts than we thought, attorneys say
UPDATES:
May 12, 5:50 p.m.: This article was updated to add comments from John Bambenek and Sean Dillon.
May 12, 3:35 p.m.: This article was updated with examples of companies hit by the attack.
This article was originally published May 12 at 3:10 p.m.
