Paying for not upgrading

June 2017 News

Tuesday 27th June saw a new cyber attack hitting the world. Not long after the WannaCry ransomware attacks that affected more than 150 countries, most famously the British NHS health service, there’s a new attack based on the same ‘EternalBlue’ exploit, thought to have been developed by the NSA and leaked by Shadow Brokers.

The new attack is known as Petya and seems to be even worse than WannaCry in that it won’t be as easy to stop. Petya takes advantage of the Server Message Block (SMB) vulnerability in Windows – which has been patched. reports that a string of large companies have already been hit, from UK advertising company WPP, through to Russian oil producer Rosneft, and the Danish shipping giant Maersk. Multinationals in Spain are also in the firing line.

Worst hit, up to the time of writing, is the Ukraine where it is said that government departments, the central bank, an aircraft manufacturer and the Kiev airport (among other large targets) have all been paralysed by Petya.

For those who have not been affected by Petya, recommends:

Ensure all versions of Windows on all your computers are patched up to the latest updates available. (Microsoft’s auto-update is a pain, but very useful.)

• The company also recommends disabling the outdated protocol SMBv1.

• Isolate all unpatched systems from the network.

If you feel unhappy about paying the $300 in Bitcoin that the criminals want to restore computers, update your systems and applications, and don’t open suspicious email attachments or even suspicious emails.

Of course, when paying the $300 you are relying on the word of a criminal. informed Hi-Tech Security Solutions that as of about 21:00 on Tuesday night, about 27 Petya victims had paid a total of just over $6800 in ransom, and did not get their files back. The company says this indicates the attack may be more cyber terrorism than simply for financial gain.

Nigel Tozer, solutions marketing director, Commvault, said: “The only reliable defence against the recent Petya ransomware attacks, is backup. Clearly the malicious forces behind this and other recent attacks continue to be one step ahead of threat detection software, so if your systems and data is held to ransom the only true means of recovery is to be able to revert back to data from the last backup before the infection.

“When files are encrypted and corrupted by a ransomware attack, cloud sync and share tools aren’t something you can rely on either, because the sync facility means cloud files are as infected as their originals. The other issue is that these cloud services, especially free or those targeted at consumers, typically don’t cover all of your data and may not always have retention policies that pre-date the attack.

“The best option, to insure against data-mincing malware, is an in-house centrally managed backup solution. Whilst reverting to the backup prior to the infection might mean losing a limited amount of data, it is nominal compared to the impact of losing all your data permanently.”

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The latest security trends at Securex South Africa 2023
Securex South Africa News Conferences & Events Training & Education
Security technology evolves at a blistering pace, so it’s important to keep up to date with changing trends in order to ensure maximised safety of human and personal assets. The Securex Seminar Theatre, powered by UNISA, is the place to be.

Sustainability School opens for enrolment
Education (Industry) News Security Services & Risk Management
Three-part programme, first developed for Schneider Electric employees, is now available for free for companies worldwide. Attendees learn how to future-proof their businesses and accelerate their decarbonisation journeys.

From the editor's desk: Get Smart
Technews Publishing News
      Welcome to the fourth issue of Hi-Tech Security Solutions for 2023, which is also the first issue of Smart Security Solutions. As noted in previous issues, Hi-Tech Security Solutions has been rebranded ...

Matt De Araujo joins Ajax Systems
Ajax Systems News Perimeter Security, Alarms & Intruder Detection
Matt De Araujo has joined Ajax Systems as Head of Sales in sub-Saharan Africa with a goal to strengthen the local team and exceed expectations.

Elvey partners with HALO
Elvey Security Technologies News CCTV, Surveillance & Remote Monitoring
Elvey Group has partnered with HALO Europe to provide Africa’s first body-worn solution with zero upfront costs. This includes an IP68-certified body camera and a 4G-connected device.

Accenture Technology Vision 2023
Editor's Choice News
New report states that generative AI is expected to usher in a ‘bold new future’ for business, merging physical and digital worlds, transforming the way people work and live.

Cyber attackers used over 500 tools and tactics in 2022
Cyber Security News
The most common root causes of attacks were unpatched vulnerabilities and compromised credentials, while ransomware continues to be the most common ‘end game’ and attacker dwell time is shrinking – for better or worse.

Economists divided on global economic recovery
Editor's Choice News
Growth outlook has strengthened in all regions, but chief economists are divided on the likelihood of a global recession in 2023; experts are concerned about trade-off between managing inflation and maintaining financial stability, with 76% anticipating central banks to struggle to bring down inflation.

AI face recognition OEM module
Suprema News Access Control & Identity Management Products
Suprema AI, a company specialized in artificial intelligence–based integrated security solutions, recently launched its high-performance face recognition OEM module called ‘Q-Face Pro’ in response to the growing need for contactless security solutions.

Disrupting power generation for the future
What if, instead of taking up 400 hectares to build a solar power plant, you could generate the same number of kilowatts on land the size of a basketball court?