printer friendly version

Another day, another attack

One of the sad things about South Africa is that we have all become hardened to crime, especially violent crime. For whatever reason, the media does not report most of the crime that happens, unless it happens to a famous person or if it has some titillation value – or unless it is so horrendous it’s guaranteed to attract readers.

It seems the same is happening globally when it comes to cybercrime. Only weeks ago we had the WannaCry attack that affected companies globally, locking people and companies out of their computers, including the British NHS (National Health Service). The Microsoft patch that would have prevented the attack had already been released, but many companies had not updated their systems.

As I write this column, the Petya attack has just happened – and it is not as easy to stop as WannaCry. Again, unpatched systems are in the firing line. Petya not only encrypts files on your hard drive, but forces a Windows reboot and in the process infects the Master Boot Record (MBR) to prevent the system from loading normally, and then encrypts the Master File Table (MFT). (A more in-depth description can be found at https://securelist.com/petya-the-two-in-one-trojan/74609/.)

To use a technical term, once infected, unless you get the decryption key you’re screwed. In this case GNLcyber.com reports that those who paid the ransom were not given the ability to unlock their systems. So is it a financial attack or some form of cyber terrorism? Another report says that the email addresses linked to the Bitcoin account users are directed to send the ransom to, is disconnected, so the criminals won’t be able to assist you even if you do pay and even if they had planned to.

I understand that Microsoft’s endless bug fixes are a pain, but they are necessary. Last month’s patch (from May) would protect from this malware (they say also blocking the Microsoft PsExec tool helps). But right now, we have governments and supermarkets, the giant Maersk shipping company, and many more big organisations around the world sitting helpless. In certain countries a government shutdown would have a positive impact on society, but in most of the world this would be a catastrophe.

The vulnerability that allows for this attack was part of the alleged dump by Shadow Brokers of the software stolen from the NSA, which was keeping it secret for its own shady activities.

Of course, in the midst of all this we still have governments who are actively trying to break secure computing by insisting they be allowed to have back doors into everything. Because they won’t tell anyone how to use it, just like the NSA didn’t tell anyone how to use the SMB vulnerability (that WannaCry and Petya use).

We know politicians have no idea what they are doing, apart from getting rich, but their booty is also at stake when there is no way to secure your bank or your financial transactions – even the offshore ones. So how about listening to the people out there who have an inkling of what is happening? There may be a cyber security skills shortage, but there are many people who would be happy to assist in national cyber protection projects – even right here in SA.

So ask yourself, who in your company is opening unknown Zip files that have appeared in their inbox?

Andrew Seldon

Editor

Share this article:

Further reading: