Analysis 'WannaCry' ransomware attack shows why Apple refused to hack terrorist's iPhone
Analysis 'WannaCry' ransomware attack shows why Apple
refused to hack terrorist's iPhone
By Paresh Dave May 12, 2017 6:05 PM
Cybersecurity researchers said a malicious program that
disabled computers at Britain's National Health Service, Russia's Interior
Ministry and companies and homes across dozens of countries Friday originated
with the National Security Agency.
Earlier this year, a hacking group calling itself Shadow
Brokers published online what it described as stolen NSA documents. They were
filled with information that hacking experts said could be used to secretly
take over and pluck data from laptops, smartphones and even smart TVs.
Friday’s attack appeared to target computers running
Microsoft Windows and took advantage of a flaw in the operating system.
Microsoft released a patch for the bug in March, but users who didn’t update
their systems remained susceptible to having their files locked up until they
made a ransom payment to attackers.
To cybersecurity experts, Friday’s incident showed
exactly why technology companies such as Microsoft, Google and Apple are so
defensive about the idea of backdoors into their services and devices.
Law enforcement agencies may want a way into highly
secure gadgets and apps to further their investigations — such as when the FBI
pressed Apple last year to hack into the iPhone used by a gunman in the San
Bernardino terror attack. But the companies have repeatedly pointed out that
there’s no safe way to build an entry point just for trusted government
organizations.
Though the NSA hasn’t confirmed it was hacked, the
purported leak of its tools shows that even supposedly secret vulnerabilities
can get into the wrong hands.
“It goes back to the mafia expression,” said John
Bambenek, threat research manager at Fidelis Cybersecurity. “The only way to
keep a secret is for three people to know it and two of them to be dead.”
Bambenek and other researchers have called for the U.S.
government to be more forthcoming with its hacking methods. Government
agencies, they acknowledge, need to be able to engage in online espionage and
warfare. But when flaws the agencies discover pose a threat to the nation’s
businesses and consumers, they should be forced to help secure systems.
“Intelligence agencies like hoarding secrets,” Bambenek
said. “But at some point, their mission isn’t hoarding secrets. It’s protecting
national security. You’re rarely the first person to find [a flaw to exploit]
and you’re not going to be the only one to know about it very long.”
Microsoft issued a fix for the vulnerability that hackers
capitalized upon Friday before the Shadow Brokers leak occurred, which experts
have speculated suggests the NSA may have tipped the company off about the
impending leak. But that sort of disclosure remains rare and too narrow, Bambenek
said.
"There’s a broad community beyond the software
company [with the flaw] that could help protect” consumers, he said. “There was
no disclosure made to us.”
In addition to homes and government agencies, Friday’s
attack hit companies including delivery giant Fedex and Spain’s biggest telecom
firm, Telefonica.
Researchers believe computers were infected after users
opened a link in a phishing email. Bambenek said a message that was purportedly
sent to workers at Telefonica carried a subject line referencing a wire
transfer and asked them to check a website for more details. That link — when
launched on a Windows computer suffering from the vulnerability discovered by
the NSA — unleashed the WannaCry program that rendered files inaccessible.
As recently as last week, about 1.7 million computers
connected to the Internet were susceptible to such an attack, said Sean Dillon,
senior security analyst at security software start-up RiskSense. Even if not
all of them were hit Friday, many could fall victim in the coming days to
similar attacks. The supposed NSA leaks included four other infection methods.
“This obviously was a well-planned and well-coordinated
attack,” Dillon said. “This probably is just the beginning.”
Nobody has claimed responsibility for carrying out the
attack.
Comments
Post a Comment