Key to Avoiding Ransomware: Update Systems Often

Every piece of software is vulnerable

Tom Puckett
May 16, 2017 - 4:00 am

WBEN Photo/Susan Rose

Categories: 

Buffalo, NY (WBEN) With the WannaCry ransomware virus attacking systems around the world, experts are advising you to do a simple thing you probably hesitate to do.

Michael McCartney of Digits LLC in Buffalo says we're always under attack. "It just seems to be getting a lot of press because (Ransomware's) become successful in its deployment worldwide, but it's no different than any new real development on the ransomware epidemic," says McCartney. "There are better next generation firewalls that can keep this stuff out of the firewall, but you can also do you part by not clicking on emails you're not familiar with."

McCartney says it can take a lot of time for you to notice you're under attack. "From the time a computer gets infected until someone knows about it is 191 days on average. That's a long time for a bad guy to walking around in your network, so if we can monitor our system better and have a comprehensive immediate response, we can avoid exposure," says McCartney.

As far as home users are concerned, McCartney said most do not install regular updates or have their computers set to auto-install.  They are reluctant to install 3rd party software updates such as browsers, internet explorer, microsoft office software. Anything that you use that runs on a computer has to be updated, regularly".  The full interview with McCartney is below.  

 

ABOUT THAT NORTH KOREA LINK

WannaCry paralyzed computers running mostly older versions of Microsoft Windows in some 150 countries. It encrypted users' computer files and displayed a message demanding $300 to $600 worth of the digital currency bitcoin to release them; failure to pay would leave the data scrambled and likely beyond repair .

The Russian security firm Kaspersky Lab said Monday that portions of the WannaCry program use the same code as malware previously distributed by the Lazarus Group, a hacker collective behind the 2014 Sony hack blamed on North Korea.

But it's possible the code was simply copied from the Lazarus malware without any other direct connection. Kaspersky said "further research can be crucial to connecting the dots."

Another security company, Symantec, has also found similarities between WannaCry and Lazarus tools, and said it's "continuing to investigate for stronger connections."

FOLLOW THE MONEY

Researchers might find some additional clues in the bitcoin accounts accepting the ransom payments. There have been three accounts identified so far, and there's no indication yet that the criminals have touched the funds. But what good is money just sitting there as digital bits?

Although bitcoin is anonymized, researchers can watch it flow from user to user. So investigators can follow the transactions until an anonymous account matches with a real person, said Steve Grobman, chief technology officer with the California security company McAfee.

But that technique is no sure bet. There are ways to convert bitcoins into cash on the sly through third parties. And even finding a real person might be no help if they're in a jurisdiction that won't cooperate.

Another possible slip-up: Nicholas Weaver, who teaches networking and security at the University of California, Berkeley, said good ransomware usually generates a unique bitcoin address for each payment to make tracing difficult. That didn't seem to happen here.

TELL-TALE SIGNS

James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington, said U.S. investigators are collecting forensic information — such as internet addresses, samples of malware or information the culprits might have inadvertently left on computers — that could be matched with the handiwork of known hackers.

Investigators might also be able to extract some information about the attacker from a previously hidden internet address connected to WannaCry's "kill switch." That switch was essentially a beacon sending the message "hey, I'm infected" to the hidden address, Weaver said.

That means the very first attempts to reach that address, which might have been recorded by spy agencies such as the NSA or Russian intelligence, could lead to "patient zero" — the first computer infected with WannaCry. That, in turn, might further narrow the focus on possible suspects.

THE PLAYERS

Forensics, though, will only get investigators so far. One challenge will be sharing intelligence in real time to move as quickly as the criminals — a tricky feat when some of the major nations involved, such as the U.S. and Russia, distrust each other.

Even if the perpetrators can be identified, bringing them to justice could be another matter. They might be hiding out in countries that wouldn't be willing to extradite suspects for prosecution, said Robert Cattanach, a former U.S. Justice Department attorney and an expert on cybersecurity.

On the other hand, the WannaCry attack hit — and annoyed — many countries. Russia was among the hardest, and Britain among the most high-profile, and both have "some pretty good investigative capabilities," Cattanach said.

 

Comments ()