Why ‘WannaCry’ must be a lesson for all

Oct 24, 2017 by infocon in  cyber security Security

May 12, 2017 is one of the most dreadful days of the year for cyber experts and its stakeholders. About 150 countries across the globe suffered a cyber-attack, affecting 200,000 computers.

It was the infamous “WannaCry” ransomware in which hackers locked people out of their computers, demanding a ransom of $300 in bitcoins. Medical care became inaccessible and factories were shut down for more than 2 days to minimize loss of confidential and further damage.

Here goes a brief on one of the most dangerous ransomware attacks in the Cyber-verse:

What is “WannaCry”?

“WannaCry” appears to have utilized a flaw in Microsoft’s software, discovered by the National Security Agency, which was quickly leaked by hackers. The malicious code that relied on the victims opening a zip file emailed to them, spread rapidly across networks locking away files one by one. From then on, the programme used Microsoft’s flaw to thrive.

Microsoft had released a security update which addressed the vulnerability in the sixteen year old Windows XP operating system, in March 2017. This update was exploited by the hackers to trigger the massive ransomware attack.

 

 

Who got affected?

Several computer networks worldwide were affected, including Telefonica as well as other major organizations in Spain. The British National Health Service (NHS), too, was forced to cancel scheduled patients.

FedEx, Deutsche Bahn, the Russian Interior  Ministry and Russian telecom MegaFon were barred from normal operating services. According to Quartz the three bitcoin wallets used in the attack received just under 300 payments totalling a sum of 48.8635565 bitcoins, which is the equivalent of about $101,000.

 

What is a ransomware attack?

The term ‘ransomware’ appeared in 2005 in the US with the first notable biggest threats to security. While cyber experts maintain it to be 2005, the history of ransomware goes back to 1989.

 

PC CYBORG advisory from 1989. Screenshot via Security Focus

 

According to Becker’s Hospital Review, the earliest ransomware attack occurred in 1989, targeting the healthcare industry. Tracing the same, the healthcare industry still remains a top target for such attacks even after twenty eight years.

Ransomware is a cyber-attack wherein hackers gain control over a computer system and block access to it until the demanded ransom is paid. Hackers get control of systems by downloading a type of malicious software onto a device within the network. This is usually done by getting a victim to click on download link by mistake. The link is normally attached with an email, which once opened, encrypts the hard drive. Once the software gets into the victim’s computer, it enables the hackers to launch an attack that locks all files it can find within that network.

The recent ‘WannaCry’, also known as Wanna Decryptor is a ransomware programme that locks all the available data in the system leaving the user with only instructions on what to do next and the Wanna Decryptor programme itself.

When the software is opened, it tells the users that the files on their computer have been encrypted. It then gives them a few days to pay up, warning that their files will otherwise be deleted. It generally gives them instructions to pay in Bitcoin, providing the Bitcoin address for it to be sent to.

 

 

What is the way out?

Larger organizations should ideally follow the guidelines provided by concerned institutions:

  • Apply the latest Microsoft security patches for this particular flaw.
  • Ensure all outgoing and incoming emails are scanned for malicious attachments.
  • Ensure anti-virus programmes are up to date and conducting regular scans.
  • Backup all key data and information.
  • Organize education programmes on malware so employees can identify scams, malicious links or emails that may contain hazardous viruses.
  • Run “penetration tests” against your network’s security at least once a year.

Many experts even suggested restoring all files from a backup. If that isn’t possible, there are tools that can decrypt and recover some information.

Govt discusses measures for safer digital transactions

Oct 18, 2017

To curb the rising cyber fraud in digital transactions, a high level meeting has proposed the imposition of a token ‘security fee’ on digital payments in India.

The meeting, focused on measures to make digital transactions safer, was held on 13 September. Chaired by Home Minister Rajnath Singh, it was attended by officers from the MeITY, Home Ministry, Department of Financial Services, Department of Telecom, Reserve Bank of India and Intelligence Bureau. All major stakeholders were present to discuss and propose ways for the same.

Prasanto K. Roy, Nasscom Internet Council Head, expressed that every digital transaction could be aimed at starting a fund for creating better infrastructure to secure digital transactions.

“A special fund could help develop security infrastructure, hire experts and secure online transactions, though a cess on digital transactions isn’t the best way of doing it,” he told ThePrint. He further said that there was a need for the Ministry of Finance and the Ministry of Electronics and Information Technology (MeitY) to make digital transactions cheaper and secure.

An official from the Ministry said on condition of anonymity, “It was also discussed that an Act needs to be in place for regularizing digital payments, which will be looked after by the Finance Ministry, and to how fix the responsibilities of agencies”.

The action came after the official figures were disclosed that indicate that cases related to e-wallets and e-payments (that were reported to banks) jumped from 13,083 cases in 2014-15 to 16,468 cases in 2015-16.

Mostly, online frauds occur when people share their passwords, 3 D secure pins, ATM pins, etc. Hence there is a need to educate people about it. “A standard procedure for all e-wallets needs to be in place as right now anyone can make a wallet just by downloading the app. The KYC norms need to be strengthened for safer transactions,” the official from the Home Ministry said.

Further, the Ministry recommended undertaking a digital transaction education campaign and creation of dedicated cyber-forensics lab. Also, training for police personnel and forensic officers needs to be in place so that they can tackle cyber fraud cases.

“As of now we do not have the manpower or expertise to deal with cyber fraud cases, which is going to be challenging…we need to be prepared,” the Home Ministry official said.

The Intelligence Bureau proposed the Indian Government ensure the introduction of necessary software that is able to detect attempts at cyber fraud. Accordingly, the software would be incorporated by payment gateways so that customers can be alerted about suspicious activity.

“There needs to be a machinery to detect out-of-bound transactions and the pattern of violations in cyber fraud cases. The machinery should be able to figure if the transaction is fraudulent by looking at its pattern and send alerts,” Nasscom’s Roy said to The Print.

 

5 Strategies for Cyber Security in Small Business Organizations

Oct 16, 2017

If you’re a small business organization, there is absolutely no reason for you to neglect cyber security. Not spending on security or relying on outdated software to protect your data – both are equally bad ideas.

Here are a few ways you should undertake to prevent damage to the reputation of your business repute:

Backups: Cyber attackers and hackers never leave an opportunity to take your data “hostage” and demand a ransom before releasing that data. Hence, small organizations must practice backing up data in the cloud or a hybrid data centre.

Update IT Systems: As malicious attacks are evermore wreaking havoc in the cyber-verse, it is essential for organizations to protect their business data at all costs. A top to bottom evaluation with an emphasis on vulnerabilities is important. Key assets like information about property, confidential personal data, etc. must be guarded against.

   Cyber security education: In any data-security effort, any individual can intentionally or not become a “weak-link”. More often, an employee nursing grudge against the organization may compromise security. To avoid such incidences, smaller organizations can always undertake a rigorous cyber security education program.

Proper planning: Included in the data-security education program should be procedures teaching employees how to react in the event of unauthorized intrusions, example, phishing or malware attempts. A detailed incident response plan that redirects to helpdesks or IT teams can have a significant impact.

Mobile device security: A lot of times employees in small organizations use their mobile devices for work and work-related communication. The thought of data passage through unsecured channels is nightmarish enough for organizations to establish policies like – (i) Categorizing and restricting the types of information that can be shared or accessed through these devices, (ii) Enforcing network access control wherein employees can access your business’s VPN and email in a reliable manner, (iii) Determining whether mobile devices provided by the business can be taken off-site.

A brief on India’s Cyber Security Status

Oct 17, 2017

The biggest story of 2016 is undoubtedly the alarming rise of cyber crime. A look at global IT industries explains that we’re facing a lack of efficient professionals. According to the Cyber Security Ventures ‘Cyber Security Jobs Report’, there were 1 million cyber security job openings in 2016. The number is expected to grow to 1.5 million by 2019.

Against the backdrop, the scenario of India’s cyber security industry is no exception. A quick glance at one of the most notable security breaches in the country shows:

1)   Cyber criminals breached the country’s largest government site – the Indian Railways Catering and Tourism Corporation (IRCTC) website, stealing around 10 million records from the server of the e-ticketing portal.

2)    A cyber criminal by the name ‘Faisal’ allegedly breached the website of Canara Bank, defacing it by inserting a malicious page and blocking some of its payment services.

3)    Fraudsters broke into the email account of Binny Bansal, CEO of Flipkart, sending two emails to the Chief Financial Officer (CFO) demanding a sum of $80,000.

Further look at similar incidents show that majority of these attacks happened in the e-commerce and banking sectors. The reason for this is found to be a high value of personally identifiable information )PII) in these industries.

According to ‘M-Trends 2016, Asia-Pacific Edition’ by Mandiant Consulting, Indian organizations are more susceptible to data breaches. Poor investments in high-end security solutions are to blame, as experts say. This must sound caution to smaller and bigger organizations both.

In the wake of this, the Indian government has started to invest money in recruiting cyber security experts. Partnerships with top international security firms have also been registered. The recent Memorandum of Understanding (MoU) between the national cyber security agencies of India and the U.K. is a step in the direction. The exchange of technical information on cyber attacks, security incidents and solutions will benefit both countries in fighting cyber crime together.

Leave a Comment

Your email address will not be published. Required fields are marked *

Comment *

This site uses Akismet to reduce spam. Learn how your comment data is processed.