This article is from the source 'nytimes' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at https://www.nytimes.com/2017/06/27/technology/ransomware-hackers.html

The article has changed 8 times. There is an RSS feed of changes available.

Version 3 Version 4
New Cyberattack Spreads in Europe, Russia and U.S. Cyberattack Hits Ukraine Then Spreads Internationally
(about 7 hours later)
Computer systems from Russia to the United States were struck on Tuesday in an international cyberattack that bore similarities to a recent assault that crippled tens of thousands of machines worldwide. Computer systems from Ukraine to the United States were struck on Tuesday in an international cyberattack that was like a recent assault that crippled tens of thousands of machines worldwide.
As reports of the attack spread quickly, the Ukrainian government said that several of its ministries, radiation monitoring at the Chernobyl nuclear facility, local banks and metro systems had been affected. A number of companies — including the Danish shipping giant Maersk; Rosneft, the Russian energy giant; Saint-Gobain, the French construction materials company; and WPP, the British advertising agency — also said they had been targeted. In Kiev, the capital of Ukraine, A.T.M.s stopped working. About 80 miles away, workers were forced to manually monitor radiation at the old Chernobyl nuclear plant when their computers failed. And tech managers at companies around the world, from Maersk, the Danish shipping conglomerate, to Merck, the drug giant in the United States, were scrambling to respond.
And in the first confirmed cases in the United States, Merck, the drug giant, confirmed that its global computer networks had been hit, as did DLA Piper, the multinational law firm. It was unclear who was behind this cyberattack, and the extent of its impact was still hard to gauge Tuesday. It started as an attack on Ukrainian government and business computer systems — an assault that appeared to have been intended to hit the day before a holiday marking the adoption in 1996 of Ukraine’s first Constitution after breaking away from the Soviet Union. It spread from there, causing collateral damage around the world.
It remains unclear who is behind this cyberattack. Like the WannaCry attacks in May, the hack on Tuesday takes over computers and demands digital ransom from their owners to regain control. This outbreak is the latest and perhaps the most sophisticated in a series of attacks that make use of dozens of hacking tools that were stolen from the National Security Agency and leaked online in April by a group called the Shadow Brokers.
“We are urgently responding to reports of another major ransomware attack on businesses in Europe,” Rob Wainwright, executive director of Europol, Europe’s police agency, said on Twitter. Like the WannaCry attacks in May, the latest global hacking took control of computers and demanded digital ransom from their owners to regain access. The new attack used the same N.S.A. hacking tool, Eternal Blue, that was used in the WannaCry incident, and two other methods to promote its spread, according to researchers at the computer security company Symantec.
Computer experts were calling the virus Petya, and said that it was similar to the WannaCry attack, which spread quickly across much of Asia and Europe. Others cautioned, however, that it could be yet another type of ransomware. The N.S.A. has not acknowledged its tools were used in WannaCry or other attacks. But computer security specialists are demanding that the agency help the rest of the world defend against the weapons it created.
At least nine European countries had been targeted in the latest attack, said Dan Smith, an information security researcher at Radware, a cybersecurity firm. “I first saw reports of this attack around 8 a.m. Eastern time coming from Ukraine, but it’s too early to tell who’s behind this,” Mr. Smith said. ”The N.S.A. needs to take a leadership role in working closely with security and operating system platform vendors such as Apple and Microsoft to address the plague that they’ve unleashed,” said Golan Ben-Oni, the global chief information officer at IDT, a Newark-based conglomerate hit by a separate attack in April that used N.S.A. hacking tools. Mr. Ben-Oni warned federal officials that more serious attacks were probably on the horizon.
Researchers at the computer security company Symantec said the new attack was using the same hacking tool created by the National Security Agency that was used in the WannaCry attacks. Called Eternal Blue, the tool was among dozens leaked online last April by a group known as the Shadow Brokers. The N.S.A. has not acknowledged its tools were used in WannaCry or other attacks. The vulnerability in Windows software used by Eternal Blue was patched by Microsoft in March, but as the WannaCry attacks demonstrated, hundreds of thousands of organizations around the world failed to properly install the fix.
The vulnerability used by Eternal Blue was patched by Microsoft last April, but as the WannaCry attacks demonstrated, hundreds of thousands of organizations around the world failed to properly install the patch. But researchers at F-Secure, the Finnish cybersecurity firm, also noted that the ransomware used at least two other vectors to spread, beyond Eternal Blue, which suggests even those who used the Microsoft patch could be vulnerable.
“Just because you roll out a patch doesn’t mean it’ll be put in place quickly,” said Carl Herberger, vice president of security at Radware. “The more bureaucratic an organization is, the higher chance it won’t have updated its software.”“Just because you roll out a patch doesn’t mean it’ll be put in place quickly,” said Carl Herberger, vice president of security at Radware. “The more bureaucratic an organization is, the higher chance it won’t have updated its software.”
Immediate reports that the computer virus was a variant of Petya suggest the attackers will be hard to trace. Petya was for sale on the so-called dark web, where its creators made the ransomware available as “ransomware as a service” — a play on Silicon Valley terminology for delivering software over the internet, according to the security firm Avast Threat Labs. Because the ransomware used at least two other ways to spread on Tuesday, even those who used the Microsoft patch could be vulnerable, according to researchers at F-Secure, the Finnish cybersecurity firm.
That means anyone can launch the ransomware with the click of a button, encrypt someone’s systems and demand a ransom to unlock it. If the victim pays, the authors of the Petya ransomware, who call themselves Janus Cybercrime Solutions, get a cut of the payment. A Microsoft spokesman said the company’s latest antivirus software should protect against the attack.
That distribution model means that pinning down the individuals responsible for Tuesday’s attack could be difficult, if nearly impossible. The Ukrainian government said several of its ministries, local banks and metro systems had been affected. A number of other European companies, including Rosneft, the Russian energy giant; Saint-Gobain, the French construction materials company; and WPP, the British advertising agency, also said they had been targeted.
The attack is actually “an improved and more lethal version of WannaCry,” according to Matthieu Suiche, a security researcher who helped contain the spread of the WannaCry ransomware last month when he created a so-called kill switch that stopped the attacks from spreading. Ukrainian officials pointed a finger at Russia on Tuesday, though Russian companies were also affected. Home Credit bank, one of Russia’s top 50 lenders, was paralyzed, with all of its offices closed, according to the RBC news website. The attack also affected Evraz, a steel manufacturing and mining company that employs about 80,000 people, the RBC website reported.
Over just the past seven days, Mr. Suiche noted that WannaCry had attempted to hit an additional 80,000 organizations, but was prevented from executing attack code because of the kill switch. In the United States, DLA Piper, the multinational law firm, also reported being hit. Hospitals in Pennsylvania were being forced to cancel surgeries after the attack hit computers at Heritage Valley Health Systems, a Pennsylvania health care provider, and its hospitals in Beaver and Sewickley, Penn., and satellite locations across the state.
On Tuesday, Mr. Suiche said there was no kill switch for the Petya attacks. A spokesman for the N.S.A. referred questions about the attack to the Department of Homeland Security. “The Department of Homeland Security is monitoring reports of cyber attacks affecting multiple global entities and is coordinating with our international and domestic cyber partners,” Scott McConnell, spokesman for D.H.S., said in a statement.
The Petya attacks could be worse than WannaCry, said Chris Hinkley, a researcher at Armor, the security firm, because these attacks encrypt and lock entire hard drives, while the earlier ransomware attacks locked only individual files. Computer specialists said the ransomware was very similar to a virus that first emerged last year called Petya. Petya means “Little Peter,” in Russian, leading some to speculate the name referred to Sergei Prokofiev’s 1936 symphony “Peter and the Wolf,” about a boy who captures a wolf.
But researchers at the security company Kaspersky Labs questioned whether the attack was something other than what has been described as the Petya attacks. The company’s data indicates around 2,000 users have been attacked so far. Reports that the computer virus was a variant of Petya suggest the attackers will be hard to trace. Petya was for sale on the so-called dark web, where its creators made the ransomware available as “ransomware as a service” — a play on Silicon Valley terminology for delivering software over the internet, according to the security firm Avast Threat Labs.
In Ukraine, the Infrastructure Ministry, the postal service, the national railway company, and one of the country’s largest communications companies, Ukrtelecom, have been affected, Volodymyr Omelyan, the country’s infrastructure minister, said in a Facebook post. That means anyone could launch the ransomware with the click of a button, encrypt someone’s systems and demand a ransom to unlock it. If the victim pays, the authors of the Petya ransomware, who call themselves Janus Cybercrime Solutions, get a cut of the payment.
Officials for the metro system in Kiev, the country’s capital, said card payments could not be accepted at the moment because of the attack. The national power grid company Kievenergo had to switch off all of its computers because of the attack, but the situation was under control, according to the Interfax-Ukraine news agency. Metro Group, a German company that runs wholesale food stores, said its operations in Ukraine had been affected, and that it was “analyzing the possible effects.” That distribution method means that pinning down the people responsible for Tuesday’s attack could be difficult.
Computer systems at the Chernobyl nuclear plant were also shut down. The computers collected data on radiation levels, and were not connected to industrial systems at the site, where, though all reactors have been decommissioned, huge volumes of radioactive waste remain. Operators said radiation monitoring was being done manually. The attack is “an improved and more lethal version of WannaCry,” according to Matthieu Suiche, a security researcher who helped contain the spread of the WannaCry ransomware when he created a kill switch that stopped the attacks.
In Russia, Home Credit bank, one of the country’s top 50 lenders, was paralyzed, with all of its offices closed, according to the RBC news website. In just the last seven days, Mr. Suiche noted that WannaCry had tried to hit an additional 80,000 organizations, but was prevented from executing attack code because of the kill switch. Petya does not have a kill switch.
“All offices can only offer consultations to clients, no banking operations are now possible,” said Artyom Moskvin, a bank teller at Home Credit’s central office in Moscow, though he denied the situation was connected to the hacking attack. “The bank is currently checking its security systems. Everything should go back to normal tomorrow.” Petya also encrypts and locks entire hard drives, while the earlier ransomware attacks locked only individual files, said Chris Hinkley, a researcher at Armor, the security firm.
The attack also affected Evraz, a steel manufacturing and mining company that employs around 80,000 people, the RBC website reported. The hackers behind Petya demanded $300 worth of the cybercurrency Bitcoin to unlock victims’ machines. By Tuesday afternoon, online records showed that 30 victims had paid the ransom, though it was not clear whether they regained access to their files. Other victims may be out of luck, after Posteo, the German email service provider, shut down the hackers’ email account.
A spokeswoman for Maersk confirmed that computer systems were down because of the attack. She said the company had been hit across different business units and sites, but declined to confirm Spanish media reports that Maersk’s operations at Spanish ports, including Algeciras and Valencia, were shut down by the attack. In Ukraine, people turned up at post offices, A.T.M.s and airports to find blank computer screens, or signs about closures. At Kiev’s central post office, a few bewildered customers milled about, holding parcels and letters, looking at a sign that said, “closed for technical reasons.”
Analysts have been warning that hackers are increasingly likely to use such ransomware attacks to gain access to people’s computers, both in a bid to cause major global disruption and for financial gain. The hackers compromised Ukrainian accounting software mandated to be used in various industries in the country, including government agencies and banks, according to researchers at Cisco Talos, the security division of the computer networking company. That allowed them to unleash their ransomware when the software, which is also used in other countries, was updated.
That was the case with the recent WannaCry computer virus, which attacked networks at hospitals in the United Kingdom, automakers’ production facilities and German train stations. The ransomware spread for five days across Ukraine, and around the world, before activating Tuesday evening.
The recent attacks appear to evade popular antivirus software. In a test of 61 antivirus solutions, only four successfully identified the ransomware. “If I had to guess, I would think this was done to send a political message,” said Craig Williams, the senior technical researcher at Talos.
One Kiev resident, Tetiana Vasylieva, was forced to borrow money from a relative after failing to withdraw money at four automated teller machines. At one A.T.M. in Kiev belonging to the Ukrainian branch of the Austrian bank Raiffeisen, a message on the screen said the machine was not functioning.
Ukraine’s Infrastructure Ministry, the postal service, the national railway company, and one of the country’s largest communications companies, Ukrtelecom, had been affected, Volodymyr Omelyan, the country’s infrastructure minister, said in a Facebook post.
Officials for the metro system in Kiev said card payments could not be accepted. The national power grid company Kievenergo had to switch off all of its computers, but the situation was under control, according to the Interfax-Ukraine news agency. Metro Group, a German company that runs wholesale food stores, said its operations in Ukraine had been affected.
At the Chernobyl plant, the computers affected by the attack collected data on radiation levels and were not connected to industrial systems at the site, where, though all reactors have been decommissioned, huge volumes of radioactive waste remain. Operators said radiation monitoring was being done manually.
Cybersecurity researchers questioned whether collecting ransom was the true objective of the attack.
“It’s entirely possible that this attack could have been a smoke screen,” said Justin Harvey, the chief security officer for the Fidelis cybersecurity company. “If you are an evil doer and you wanted to cause mayhem, why wouldn’t you try to first mask it as something else?”