A devastating global cyber attack is imminent, warn
experts: The hack, called 'ExplodingCan' could target computers running
Microsoft Windows 2003
The hack targets computers worldwide running on Microsoft
Windows 2003
It exploits a known flaw in the servers, triggering a
buffer overflow
This allows hackers to remotely access the computer, and
plant ransomware
By SHIVALI BEST FOR MAILONLINE PUBLISHED: 08:10 EDT, 5
June 2017 | UPDATED: 08:11 EDT, 5 June 2017
Experts have warned that a devastating global cyber
attack is imminent.
The hack, called 'ExplodingCan', targets computers
running on Microsoft Windows 2003, which means that it could be used to attack
375,000 computers worldwide.
This puts it in the same risk category as last month's
WannaCry ransomware attack which caused mayhem around the world, crippling
vital servers such as those used by the NHS.
WHAT IS EXPLODINGCAN?
The ExplodingCan hack targets Microsoft Windows 2003
servers running the Internet Information Services version 6.0 (IIS 6.0) web
server.
The attack exploits a known flaw in the IIS 6.0 servers,
triggering a buffer overflow.
This can then be used for remote access to the computer,
and could allow hackers to plant ransomware in a similar fashion to the
WannaCry worm.
And if you do find yourself a victim of the attack, not
even Microsoft can help you, as the firm has declared Windows 2003 out of
support.
ExplodingCan has been created by the Shadow Brokers
hacking group, which was also responsible for the WannaCry attack, and
attributed to an organisation linked to the NSA.
The hack targets Microsoft Windows 2003 servers running
the Internet Information Services version 6.0 (IIS 6.0) web server.
According to Manchester-based security company, Secarma,
ExplodingCan exploits a known flaw in the IIS 6.0 servers, triggering a buffer
overflow.
This in turn can be used for remote access to the
computer, and could allow hackers to plant ransomware in a similar fashion to
the WannaCry worm.
Paul Harris, managing director of Secarma, said:
'Ultimately this is in the same risk category as the WannaCry attacks.
'It's another way for cybercriminals and hacking teams to
access your environment and, once they're in, the internal parts of these
systems are wide open to a variety of different attack vectors.'
And if you do find yourself a victim of the attack, not
even Microsoft can help you, as the firm has declared Windows 2003 out of
support.
Worldwide, there around 375,000 IIS 6.0 servers that
could be vulnerable, although an exact number is difficult to pinpoint.
Mr Harris said that Secarma couldn't test exactly how
many systems were vulnerable without breaking UK computer security laws.
But the firm has shared its findings with the UK's
National Cyber Security Centre, and is advising users to update their Windows
2003 servers.
Even using this checklist can't guarantee stopping every
attack or preventing every breach. But following these steps will make it
significantly harder for hackers to succeed.
1) Enable two-factor authentication (2FA). Most major
online services, from Amazon to Apple, today support 2FA.
When it's set up, the system asks for a login and
password just like usual – but then sends a unique numeric code to another
device, using text message, email or a specialized app.
Without access to that other device, the login is refused.
That makes it much harder to hack into someone's account – but users have to
enable it themselves.
2) Encrypt your internet traffic. A virtual private
network (VPN) service encrypts digital communications, making it hard for
hackers to intercept them.
Everyone should subscribe to a VPN service, some of which
are free, and use it whenever connecting a device to a public or unknown Wi-Fi
network.
3) Tighten up your password security. This is easier than
it sounds, and the danger is real: Hackers often steal a login and password
from one site and try to use it on others.
To make it simple to generate – and remember – long,
strong and unique passwords, subscribe to a reputable password manager that
suggests strong passwords and stores them in an encrypted file on your own
computer.
4) Monitor your devices' behind-the-scenes activities.
Many computer programs and mobile apps keep running even when they are not
actively in use.
Most computers, phones and tablets have a built-in
activity monitor that lets users see the device's memory use and network
traffic in real time.
You can see which apps are sending and receiving internet
data, for example. If you see something happening that shouldn't be, the
activity monitor will also let you close the offending program completely.
5) Never open hyperlinks or attachments in any emails
that are suspicious.
Even when they appear to come from a friend or coworker,
use extreme caution – their email address might have been compromised by
someone trying to attack you.
When in doubt, call the person or company directly to
check first – and do so using an official number, never the phone number listed
in the email.
- Arun Vishwanath, Associate Professor of Communication,
University at Buffalo, State University of New York
Comments
Post a Comment