Ransomware threat: Get patched, find a firewall or upgrade fast

May 15, 2017

New Delhi, May 15: It was coming. On March 14 this year, Microsoft released a security update which addressed the vulnerability in the 16-year-old Windows XP operating system that the hackers behind the massive ransomware attack exploited and created havoc in 150 countries.

wannacry

The vulnerability in the Microsoft Windows software — exploited by “WannaCrypt” — crippled computers from hospitals in Britain to police stations in India, with hackers demanding hundreds of dollars from the users for them to regain control over their data.

Once Microsoft released the patch for the vulnerability — exploited by hacker group “Shadow Brokers” after stealing a software from the US National Security Agency (NSA) — some Window XP users installed the update called “Microsoft Security Bulletin MS17-010” on their desktops and laptops.

But several didn"t.

There are nearly 150 million computers running Windows XP operation system globally. Those who didn"t pay heed to the Windows XP patch are the ones who have fallen prey to the world"s biggest ransomware attack.

Microsoft which had discontiued security updates to its out-of-date software, has also provided a security update for all customers using Windows 8 and Windows Server 2003, anticipating further attacks on these earlier platforms being used by millions.

According to the company, “customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March.

“If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible,” said Phillip Misner, Principal Security Group Manager, Microsoft Security Response Centre, in a statement.

Meanwhile, “WannaCrypt” locked up machines, encrypted files and demanded approximately $600 in Bitcoin for a recovery key.

According to global cyber security firms, paying heed to updates can only save your data from being put to ransom.

“Install the official patch from Microsoft that closes the vulnerability used in the attack. Ensure that security solutions are switched on all nodes of the network. If Kaspersky Lab"s solution is used, ensure that it includes the "System Watcher", a behavioural proactive detection component and that it is switched on,” Altaf Halde, Managing Director of Kaspersky Lab (South Asia), told.

“Run the "Critical Area Scan" task in Kaspersky Lab"s solution to detect possible infection as soon as possible (otherwise it will be detected automatically, if not switched off, within 24 hours),” he added.

According to Subhendu Sahu, Acting Country Manager for India, FireEye, the ransomware poses high risks to organisations using potentially vulnerable Windows machines.

“We can certainly expect follow-on attacks. Organisations seeking to take risk management steps related to this campaign should install the latest Windows patches. They should also use the indicators of compromise which are associated with this activity. FireEye has also taken steps to help secure its customers,” Sahu told.

As investigators were working to track down those responsible for the ransomware attack, Microsoft President and Chief Legal Officer Brad Smith said the governments should treat this attack as a “wake-up call”.

The news led software security providers to ramp up anti-malware software.

“Upon learning of these incidents, McAfee quickly began working to analyse samples of the ransomware and develop mitigation guidance and detection updates for its customers. McAfee has subsequently provided DAT (that contain data in text or binary format) updates to all its customers and provided them and the public further analysis on the attacks,” Ian Yip, Chief Technology Officer, Asia Pacific, McAfee, told.

If you are a home Windows XP user, patch immediately follow up with an upgrade. If you are running a vulnerable system and cannot install the patch for some reason, try doing the following:

“Disable SMBv1 (a server component) with the steps documented at "Microsoft Knowledge Base Article 2696547" and as recommended previously. Consider adding a rule on your router or firewall to block incoming Server Message Block (SMB) traffic on port 445,” said a report in the technology website Engadget.

“This is big and set to get bigger. We haven"t seen anything like this since Conficker in 2008,” Amit Nath, Head of Asia Pacific-Corporate Business at cyber security firm F-Secure Corporation, told IANS.

The Conficker worm infected millions of computers including government, business and home computers in over 190 countries.
Always make sure your files are backed up.

“That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup. Using Cloud storage with anti-virus scanning abilities to share files will help users to mitigate any possible threats,” suggested Anand Ramamoorthy, Managing Director, South Asia, McAfee.

Remember this: “WannaCrypt” probably won"t work across the internet for PCs behind a firewall or router.

“But if a server is connected directly to the internet or a PC is on the same network as an infected computer, it can spread quickly — which is exactly what has happened,” the Engadget report added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 31,2020

Cape Canaveral, May 31: SpaceX, the private rocket company of billionaire entrepreneur Elon Musk, launched two Americans into orbit from Florida on Saturday in a landmark mission marking the first spaceflight of NASA astronauts from U.S. soil in nine years.

A SpaceX Falcon 9 rocket lifted off from the Kennedy Space Center at 3:22 p.m. EDT (19:22 GMT), launching Doug Hurley and Bob Behnken on a 19-hour ride aboard the company’s newly designed Crew Dragon capsule bound for the International Space Station.

Just before liftoff, Hurley said, “SpaceX, we’re go for launch. Let’s light this candle,” paraphrasing the famous comment uttered on the launch pad in 1961 by Alan Shepard, the first American flown into space.

Minutes after launch, the first-stage booster rocket of the Falcon 9 separated from the upper second-stage rocket and flew itself back to Earth to descend safely onto a landing platform floating in the Atlantic.

High above the Earth, the Crew Dragon jettisoned moments later from the second-stage rocket, sending the capsule on its way to the space station.

The exhilarating spectacle of the rocket soaring flawlessly into the heavens came as a welcome triumph for a nation gripped by racially-charged civil unrest as well as ongoing fear and economic upheaval from the coronavirus pandemic.

The Falcon 9 took off from the same launch pad used by NASA’s final space shuttle flight, piloted by Hurley, in 2011. Since then, NASA astronauts have had to hitch rides into orbit aboard Russia’s Soyuz spacecraft.

“It’s incredible, the power, the technology,” said U.S. President Donald Trump, who was at Kennedy Space Center at Cape Canaveral in Florida for the launch. “That was a beautiful sight to see.”

The mission’s first launch attempt on Wednesday was called off with less than 17 minutes remaining on the countdown clock. Weather again threatened Saturday’s launch, but cleared in time to proceed with the mission.

SPACEFLIGHT MILESTONES

NASA chief Jim Bridenstine has said resuming launches of American astronauts on American-made rockets from U.S. soil is the space agency’s top priority.

“I’m breathing a sigh of relief, but I will also tell you I’m not gonna celebrate until Bob and Doug are home safely.” Bridenstine said.

For Musk, the launch represents another milestone for the reusable rockets his company pioneered to make spaceflight less costly and more frequent. And it marks the first time commercially developed space vehicles - owned and operated by a private entity rather than NASA - have carried Americans into orbit.

The last time NASA launched astronauts into space aboard a brand new vehicle was 40 years ago at the start of the space shuttle program.

Musk, the South African-born high-tech entrepreneur who made his fortune in Silicon Valley, is also chief executive of electric carmaker and battery manufacturer Tesla Inc. He founded Hawthorne, California-based SpaceX, formally known as Space Exploration Technologies, in 2002.

Hurley, 53, and Behnken, 49, NASA employees under contract to fly with SpaceX, are expected to remain at the space station for several weeks, assisting a short-handed crew aboard the orbital laboratory.

Boeing Co, producing its own launch system in competition with SpaceX, is expected to fly its CST-100 Starliner vehicle with astronauts aboard for the first time next year. NASA has awarded nearly $8 billion combined to SpaceX and Boeing for development of their rival rockets.

Trump also hailed the launch as a major advance toward the goal of eventually sending humans to Mars.

He was joined at the viewing by Musk, as well as Vice President Mike Pence, Commerce Secretary Wilbur Ross, Education Secretary Betsy DeVos, Florida congressman Matt Gaetz and Senator Rick Scott.

Earlier on Saturday, the crew bid goodbye to their families. Prior to climbing into a specially designed Tesla automobile for the ride to the launch site, Behnken told his young son, “Be good for mom. Make her life easy.”

During the drive, Behnken and Hurley passed former astronaut Garrett Reisman who held a sign saying, “Take me with you.”

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 19,2020

Cybersecurity researchers on Monday warned of a Trojan malware campaign which is targeting India's co-operative banks using COVID-19 as a bait.

Seqrite, the enterprise arm of IT security firm Quick Heal Technologies, detected the new wave of Adwind Java Remote Access Trojan (RAT) campaign.

Researchers at Seqrite warned that if attackers are successful, they can take over the victim's device to steal sensitive data like SWIFT logins and customer details and move laterally to launch large scale cyberattacks and financial frauds.

According to the researchers, the Java RAT campaign starts with a spear-phishing email which claims to have originated from either the Reserve Bank of India or a nationalised bank.

The content of the email refers to COVID-19 guidelines or a financial transaction, with detailed information in an attachment, which is a zip file containing a JAR based malware.

Upon further investigation, researchers at Seqrite found that the JAR based malware is a Remote Access Trojan that can run on any machine which has Java runtime enabled and hence it can impact a variety of endpoints, irrespective of their base operating system.

Once the RAT is installed, the attacker can take over the victim's device, send commands from a remote machine, and spread laterally in the network.

In addition, this malware can also log keystrokes, capture screenshots, download additional payloads, and extract sensitive user information, Seqrite said, adding that such attack campaigns can effectively jeopardise the privacy and security of sensitive data at the co-operative banks and result in large scale attacks and financial frauds.

To prevent such attacks, users need to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails.

Banks should also keep their operating systems updated and have a full-fledged security solution installed on all the devices, Seqrite advised.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
February 6,2020

Washington D.C., Feb 6: An international team of astronomers has found an unusual monster galaxy that existed about 12 billion years ago when the universe was only 1.8 billion years old.

The team of astronomers was led by scientists at the University of California, Riverside.

Dubbed XMM-2599, the galaxy formed stars at a high rate and then died. Why it suddenly stopped forming stars is unclear.

"Even before the universe was 2 billion years old, XMM-2599 had already formed a mass of more than 300 billion suns, making it an ultra massive galaxy," said Benjamin Forrest, a postdoctoral researcher in the UC Riverside Department of Physics and Astronomy and the study's lead author.

"More remarkably, we show that XMM-2599 formed most of its stars in a huge frenzy when the universe was less than 1 billion years old and then became inactive by the time the universe was only 1.8 billion years old," Forrest added.

The team used spectroscopic observations from the W. M. Keck Observatory's powerful Multi-Object Spectrograph for Infrared Exploration or MOSFIRE, to make detailed measurements of XMM-2599 and precisely quantify its distance.

The study results appear in the Astrophysical Journal.

"In this epoch, very few galaxies have stopped forming stars, and none are as massive as XMM-2599," said Gillian Wilson, a professor of physics and astronomy at UCR in whose lab Forrest works.

"The mere existence of ultramassive galaxies like XMM-2599 proves quite a challenge to numerical models. Even though such massive galaxies are incredibly rare at this epoch, the models do predict them."

"The predicted galaxies, however, are expected to be actively forming stars. What makes XMM-2599 so interesting, unusual, and surprising is that it is no longer forming stars, perhaps because it stopped getting fuel or its black hole began to turn on. Our results call for changes in how models turn off star formation in early galaxies," the professor stated.

The research team found XMM-2599 formed more than 1,000 solar masses a year in stars at its peak of activity -- an extremely high rate of star formation. In contrast, the Milky Way forms about one new star a year.

"XMM-2599 may be a descendant of a population of highly star-forming dusty galaxies in the very early universe that new infrared telescopes have recently discovered," said Danilo Marchesini, an associate professor of astronomy at Tufts University and a co-author on the study.

"We have caught XMM-2599 in its inactive phase," Wilson said, who led the W. M. Keck Observatory data acquisition
Co-author Michael Cooper, a professor of astronomy at UC Irvine, said this outcome is a strong possibility.

"Perhaps during the following 11.7 billion years of cosmic history, XMM-2599 will become the central member of one of the brightest and most massive clusters of galaxies in the local universe," he said.

"Alternatively, it could continue to exist in isolation. Or we could have a scenario that lies between these two outcomes," he stated.

The study was supported by grants from the National Science Foundation and NASA.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.