Ransomware 'second wave' could be worse than first, say experts
559 reading now
London: Security experts are warning that the global cyber attack that began on Friday is likely to be magnified in the new working week as users return to their offices and turn on their computers.
Many workers, particularly in Asia, had logged off on Friday before the malicious software, stolen from the US government, began proliferating across computer systems around the world. So the true effect of the attack may emerge on Monday as employees return and log in.
Play Video
Play Video
DON'T PLAY New version of ransomware worm expected
Cyber security experts warning that new versions of the ransomware that crippled businesses and schools across the globe may wreak fresh havoc as employees return to work.
Moreover, copycat variants of the malicious software behind the attacks have begun to spread, according to experts.
"We are in the second wave," said Matthieu Suiche of Comae Technologies, a cybersecurity company based in the United Arab Emirates. "As expected, the attackers have released new variants of the malware. We can surely expect more." RELATED CONTENT
The cyberattack has hit 200,000 computers in more than 150 countries, said Rob Wainwright, executive director of Europol, the European Union's police agency.
"At the moment, we are in the face of an escalating threat," he told the British network ITV Sunday. "The numbers are going up. I am worried about how the numbers will continue to grow when people go to work and turn their machines on on Monday morning."
Advertisement
In the attack, infected computers have all their documents and important user files scrambled with strong encryption, and victims, without access to good back-ups of that data, have two choices: kiss the data goodbye, or pay the ransom - the equivalent of approximately $US300 ($406) worth of the virtual currency Bitcoin.
Security researcher Brian Krebs said the scammers appeared to have made just $35,000 so far in the attack.
SHARE
SHARE ON FACEBOOKSHARE
SHARE ON TWITTERTWEET
LINK
Affected: Telefonica of Spain. Photo: AP
Among the organisations hit were FedEx in the United States, the Spanish telecom giant Telefonica, the French car maker Renault, universities in China, Germany's federal railway system and Russia's Interior Ministry. The most disruptive attacks infected Britain's public health system, where operations had to be rescheduled and some patients were turned away from emergency rooms.
One Australian business is confirmed to have been affected.
SHARE
SHARE ON FACEBOOKSHARE
SHARE ON TWITTERTWEET
LINK
A screenshot of the warning screen from a purported ransomware attack, as captured by a computer user in Taiwan, is seen on laptop in Beijing. Photo: AP
Prime Minister Malcolm Turnbull's cyber security adviser, Alastair MacGibbon, said on Sunday there had been one confirmed incident in Australia, but warned it was likely more computer systems would eventually be hit.
"We have one likely incident which is being investigated but we believe there could be more out there.
"People going back to work on Monday may switch on their computers and see their systems have been impacted," he said.
Mr MacGibbon declined to comment on the identity or type of the business impacted by the unprecedented cyber attack but said it was a small company, which did not provide critical infrastructure.
A 22-year-old British researcher who uses the Twitter name MalwareTech has been credited with inadvertently helping to staunch the spread of the assault by identifying the web domain for the hackers' "kill switch" - a way of disabling the malware.
On Sunday, MalwareTech was one of many security experts warning that a less-vulnerable version of the malware is likely to be released. On Twitter, he urged users to immediately install a security patch for older versions of Microsoft's Windows, including Windows XP.
Robert Pritchard, a former cyber security expert at Britain's defence ministry, said that security specialists might not be able to keep pace with the hackers.
"This vulnerability still exits; other people are bound to exploit it," he said.
Microsoft said in a blog post on Saturday that it was taking the "highly unusual" step of providing the patch for older versions of Windows it was otherwise no longer supporting, including Windows XP and Windows Server 2003.
While the scale of the attack shows Microsoft needs to strengthen its own capabilities, "there is simply no way for customers to protect themselves against threats unless they update their system", Smith said in his blog post.
"Otherwise they're literally fighting the problems of the present with tools from the past.
"This attack is a powerful reminder that information technology basics like keeping computers current and patched are a high responsibility for everyone, and it's something every top executive should support." New York Times, Fairfax Media
TNT Price at posting:
8.0¢ Sentiment: Buy Disclosure: Held
MalwareTech @MalwareTechBlog
