Security Experts Work to Contain Fallout From Cyberattacks

Computer security experts struggled Saturday to contain the fallout from audacious cyberattacks that rippled across the globe, demanding ransom from users with the threat that their data would be destroyed.

کد خبر: ۶۹۳۵۹۹

تاریخ: ۲۳ ارديبهشت ۱۳۹۶ - ۱۱:۳۵

The malicious software, transmitted via email and stolen from the National Security Agency, exposed the vulnerability of computer systems at government agencies, universities, health care systems and other institutions in scores of countries hit by what was described as the largest ransomware attack ever.

In Asia, there were widespread reports Saturday of attacks at universities, with students locked out of their theses and final papers as graduation loomed. One tech media site posted an image of a college computer lab that showed several screens displaying the red-and-white ransom note associated with the virus.

The Chinese online security company Qihoo 360 issued a warning about the virus, saying that many networks there had been hit and that some computers used to mine Bitcoin in China were among those infected. Qihoo also warned that education networks were particularly vulnerable because they were set up to more openly share data and resources like printers, leaving them relatively unprotected.

Malware problems were reported at several universities in Asia, including at Shandong University, a top school in northeast China. The university issued an online notice urging faculty and students to update their software as quickly as possible against the malware to prevent it from encrypting files and demanding a ransom payment.

"There is often no other way to decrypt the file, except to pay a high ransom to decrypt and recover the documents, learning materials and personal data,” the notice said.

The university advised faculty members and students to install authentic Microsoft software and to contact a school office for help in doing so.

The attacks began with a simple phishing email, similar to the one Russian hackers used in the attacks on the Democratic National Committee and other targets last year. They then quickly spread through victims’ systems using a hacking method that the N.S.A. is believed to have developed as part of its arsenal of cyberweapons. Finally, the attacks encrypt the computer systems of the victims, locking them out of critical data, including patient records in Britain.

"Something like this was always inevitable,” said Brian Lord, a former deputy director for intelligence and cyber operations at Government Communications Headquarters, Britain’s equivalent to the N.S.A.

"It was well thought-out, well timed and well coordinated,” he added. "But fundamentally, there is nothing unusual about its delivery. It is still fundamentally robbery and extortion.”

The severity of the attacks in developing countries like Russia, China and India highlighted the problem of illegally copied software, which tends to be more vulnerable to malware like the one that spread globally on Friday and Saturday.

Yet even users of authentic software who had not installed a recent security update would have been vulnerable, underscoring the susceptibility of networks around the world to hackers and opportunists.

Illegal copying of software has long been rampant in China. Microsoft and other Western companies have complained for years that the large majority of computers running their software were using pirated versions.

The spread of hacking attacks in recent years has made original versions of software more popular, as they typically provide automatic updates of security upgrades. But the release by Edward Snowden of extensive information about hacking by the United States government — much of which was aimed at monitoring China’s rapid military buildup — has alarmed the Chinese leadership. It also accelerated a broad push to develop Chinese-brand software and hardware that is difficult for Western intelligence agencies to penetrate but still allows comprehensive monitoring of the population by Chinese security agencies.

With a large number of computers running old versions of Windows and a tendency to avoid paying for security software, China has become one of the world’s hotbeds of malware and hackers for hire. News of the virus was trending on Weibo, the country’s Twitter-like service, though reports of the impact were largely isolated to universities. China may have been spared a worse outbreak partly because the virus spread via email; many in China prefer to use messaging services instead.

A study last year by The Software Alliance, a trade association of vendors, found that a third of the software running on computers worldwide in 2015 was not properly licensed and had apparently been pirated. That represented a sharp drop from the alliance’s previous study, which found that 43 percent of the software running worldwide was not licensed.

But in China, the share of all unlicensed software was a steep 70 percent in 2015, down from 74 percent in 2013, The Software Alliance found. Few countries come close to China in this regard, but Russia’s share was 64 percent in 2015, and India’s was 58 percent.

Security firms said the attacks had spread to more than 74 countries, with Russia being the worst hit, followed by Ukraine, India and Taiwan, said Kaspersky Lab, a Russian cybersecurity firm.