Paying for not upgrading

June 2017 News & Events

Tuesday 27th June saw a new cyber attack hitting the world. Not long after the WannaCry ransomware attacks that affected more than 150 countries, most famously the British NHS health service, there’s a new attack based on the same ‘EternalBlue’ exploit, thought to have been developed by the NSA and leaked by Shadow Brokers.

The new attack is known as Petya and seems to be even worse than WannaCry in that it won’t be as easy to stop. Petya takes advantage of the Server Message Block (SMB) vulnerability in Windows – which has been patched.

GNLcyber.com reports that a string of large companies have already been hit, from UK advertising company WPP, through to Russian oil producer Rosneft, and the Danish shipping giant Maersk. Multinationals in Spain are also in the firing line.

Worst hit, up to the time of writing, is the Ukraine where it is said that government departments, the central bank, an aircraft manufacturer and the Kiev airport (among other large targets) have all been paralysed by Petya.

For those who have not been affected by Petya, GNLcyber.com recommends:

Ensure all versions of Windows on all your computers are patched up to the latest updates available. (Microsoft’s auto-update is a pain, but very useful.)

• The company also recommends disabling the outdated protocol SMBv1.

• Isolate all unpatched systems from the network.

If you feel unhappy about paying the $300 in Bitcoin that the criminals want to restore computers, update your systems and applications, and don’t open suspicious email attachments or even suspicious emails.

Of course, when paying the $300 you are relying on the word of a criminal. GNLcyber.com informed Hi-Tech Security Solutions that as of about 21:00 on Tuesday night, about 27 Petya victims had paid a total of just over $6800 in ransom, and did not get their files back. The company says this indicates the attack may be more cyber terrorism than simply for financial gain.

Nigel Tozer, solutions marketing director, Commvault, said: “The only reliable defence against the recent Petya ransomware attacks, is backup. Clearly the malicious forces behind this and other recent attacks continue to be one step ahead of threat detection software, so if your systems and data is held to ransom the only true means of recovery is to be able to revert back to data from the last backup before the infection.

“When files are encrypted and corrupted by a ransomware attack, cloud sync and share tools aren’t something you can rely on either, because the sync facility means cloud files are as infected as their originals. The other issue is that these cloud services, especially free or those targeted at consumers, typically don’t cover all of your data and may not always have retention policies that pre-date the attack.

“The best option, to insure against data-mincing malware, is an in-house centrally managed backup solution. Whilst reverting to the backup prior to the infection might mean losing a limited amount of data, it is nominal compared to the impact of losing all your data permanently.”





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Pentagon appointed as Milestone distributor
Elvey Security Technologies News & Events Surveillance
Milestone Systems appointed Pentagon Distribution (an Elvey Group company within the Hudaco Group of Companies) as a distributor. XProtect’s open architecture means no lock-in and the ability to customise the connected video solution that will accomplish the job.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
Sales basics for security installers
News & Events
Being the best security business in South Africa means little if no one uses your services. Your business success is only partly linked to how good you are at security installations.

Read more...
From security technician to salesperson
News & Events
Being great at security sales starts with having the right mindset. How you think informs what you say and how you act; and how you act informs the results you will achieve in your business.

Read more...
From the Editor's Desk: Something old and something new
Technews Publishing News & Events
      Welcome to the 2024 edition of SMART Security Solutions’ Mining Handbook. Mining is a challenging industry for security professionals, although security is a challenge on this continent, no matter your ...

Read more...
Risk management: There's an app for that
Editor's Choice News & Events Risk Management & Resilience
Zulu Consulting has streamlined the corporate risk management process with the launch of Risk-IO, a web-based app designed to consolidate and guide risk managers through the process, monitoring progress as one proceeds.

Read more...
Integrated information platform for risk management
Editor's Choice News & Events Risk Management & Resilience
Online Intelligence recently launched version 7 of its CiiMS risk and security platform. Speaking to SMART Security Solutions after the launch event, the company’s Arnold van den Bout described the enhancements in version 7.

Read more...
Unlocking Africa's AI potential
Editor's Choice News & Events AI & Data Analytics
Africa's AI market is set to grow exponentially; by investing in AI education, training, and ethical practices, African nations can harness the power of AI to transform the continent and create a brighter future for its people.

Read more...
Linking of security officers by security businesses
PSiRA (Private Security Ind. Regulatory Authority) News & Events Risk Management & Resilience
[Sponsored] By law, all security businesses are required to declare their employees to PSiRA so that they can be accounted for administratively. Failure to link employees by security businesses is a contravention of the Code of Conduct and a criminal offence.

Read more...
Milestone XPerience Day South Africa
Milestone Systems News & Events
The 2024 Milestone XPerience Day in Johannesburg took place on 01 February 2024, where the video technology sector’s brightest and best minds gathered to share information and networking.

Read more...