"The culprit was “ransomware” known as WanaCryptOr 2.0, or WannaCry. It operates by encrypting a computer system and demanding a ransom to release it. This money would be paid in the digital currency bitcoin to an unknown source, who would — in theory, at least — provide a decryption key to unlock the system. To do all this, the software exploits a vulnerability in Microsoft Windows that is thought to have been first identified by the National Security Agency and was later leaked online."
The Washington Post
One main idea not lost here is that the source of the weaponized software is the American National Security Agency that was attacked and from which its weapons were pilfered and shared for criminals and terrorists to use at will.
In that sense, we are our worst enemy. Americans invent weapons that are most dangerous when they fall into enemy hands to be used against us.
NSA, source of weaponized software
ReplyDeleteView in your browser
The Hill Technology
Facebook Twitter LinkedIn Email
MICROSOFT CALLS OUT GOVERNMENT HACKING PRACTICES: On the heels of a widespread "ransomware" attack that may have used leaked National Security Agency hacking methods, Microsoft is calling for governments to cease stockpiling secret means of bypassing software security.
"Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen," wrote Brad Smith, president and chief legal officer at Microsoft, on a company blog Sunday evening.
Ransomware is a type of cyberattack that encrypts a target's files, with the attacker providing the decryption key only after a ransom is paid, usually in bitcoin.
WanaDecrypt0r, alternately known by names like Wanna Cry, has struck hundreds of thousands of computers in more than 100 nations since the attack began Friday morning. Victims range from hospitals in the United Kingdom, a telecom company in Spain, U.S.-based FedEx, and the Russian Ministry of the Interior.
WanaDecrypt0r was so virulent in part because it used a Windows hacking tool that appears to have been stolen from the NSA and leaked by a hacking group known as the Shadow Brokers. Though Microsoft had patched the security hole in Windows, businesses often lag in installing updates for reasons including industry-specific software being incompatible with the most current version of operating systems.
"In February [we called] for a new 'Digital Geneva Convention' to govern these issues, including a new requirement for governments to report vulnerabilities to vendors, rather than stockpile, sell, or exploit them," wrote Smith.
By reporting bugs instead of using them to conduct cyber espionage, manufacturers would be able to increase cybersecurity for all of its users -- but that would come at the cost of intelligence and sabotage operations.
Read more here, from our cybersecurity colleague Joe Uchill.