Eliana Willis

More stories

  • 175 Shares199 Views

    in Information Technology

    How much economic damage would be done if a cyberattack took out the internet?

    The recent closure of Colonial Pipeline’s natural gas distribution infrastructure from a ransomware attack brings up a question: What economic damage could be caused by a cyberattack that would render the internet unusable for an hour, 10 hours, or a day? 

    ZDNet Recommends

    Merchant Machine, a UK-based payments information service, took a stab at figuring out the economic damage that the loss of the internet would create, and their answer is that the world economy would lose $2.1 billion per hour — rising to $51 billion after 24 hours.The larger the country’s economy, the larger the loss. The US economy would be on a $306.3 million an hour loss rate, or $7.3 billion after 24 hours. China would lose about $244 million per hour or $5.8 billion after 24 hours.Similarly, the largest retailers will hurt the most. Amazon is out of pocket by $44 million per hour. Interestingly, advertising-supported Instagram would lose even more at $53 million per hour, according to Merchant Marine.The calculation was done simply by using information from Netblocks and dividing company annual revenues by the number of hours in a year. Such broad studies do not take into account practicalities such as being able to complete a commercial transaction in the following hour or day or week when internet connectivity would be restored. Is that really lost revenue or is it just delayed?However, the report is essentially a breakdown on the rise of dependence on digital commercial transactions — the importance of the internet is undeniable, but there are also private networks that do not rely on the internet to complete commercial transactions.A more detailed analysis of each country’s dependence on the internet can be seen here.

    more coverage More

  • 175 Shares179 Views

    in Artificial Intelligence

    There’s a symphony in the antibody protein the body makes to neutralize the coronavirus

    The pandemic reached a new milestone this spring with the rollout of Covid-19 vaccines. MIT Professor Markus Buehler marked the occasion by writing “Protein Antibody in E Minor,” an orchestral piece performed last month by South Korea’s Lindenbaum Festival Orchestra. The room was empty, but the message was clear.

    “It’s a hopeful piece as we enter this new phase in the pandemic,” says Buehler, the McAfee Professor of Engineering at MIT, and also a composer of experimental music.

    “This is the beginning of a musical healing project,” adds Hyung Joon Won, a Seoul-based violinist who initiated the collaboration.

    “Protein Antibody in E Minor” is the sequel to “Viral Counterpoint of the Spike Protein,” a piece Buehler wrote last spring during the first wave of coronavirus infections. Picked up by the media, “Viral Counterpoint” went global, like the virus itself, reaching Won, who at the time was performing for patients hospitalized with Covid-19. Won became the first in a series of artists to approach Buehler about collaborating.

    At Won’s request, Buehler adapted “Viral Counterpoint” for the violin. This spring, the two musicians teamed up again, with Buehler translating the coronavirus-attacking antibody protein into a score for a 10-piece orchestra.

    The two pieces are as different as the proteins they are based on. “Protein Antibody” is harmonious and playful; “Viral Counterpoint” is foreboding, even sinister. “Protein Antibody,” which is based on the part of the protein that attaches to SARS-CoV-2, runs for five minutes; “Viral Counterpoint,” which represents the virus’s entire spike protein, meanders for 50.

    The antibody protein’s straightforward shape lent itself to a classical composition, says Buehler. The intricate folds of the spike protein, by contrast, required a more complex representation.

    Both pieces use a theory that Buehler devised for translating protein structures into musical scores. Both proteins — antigen and pathogen — have 20 amino acids, which can be expressed as 20 unique vibrational tones. Proteins, like other molecules, vibrate at different frequencies, a phenomenon Buehler has used to “see” the virus and its variants, capturing their complex entanglements in a musical score.

    In work with the MIT-IBM Watson AI Lab and PhD student Yiwen Hu, Buehler discovered that the proteins that stud SARS-Cov-2 vibrate less frequently and intensely than its more lethal cousins, SARS and MERS. He hypothesizes that the viruses use vibrations to jimmy their way into cells; the more energetic the protein, the deadlier the virus or mutation.

    Play video

    The molecular mechanics of the pandemic: MERS, SARS and COVID-19

    “As the coronavirus continues to mutate, this method gives us another way of studying the variants and the threat they pose,” says Buehler. “It also shows the importance of considering proteins as vibrating objects in their biological context.”

    Translating proteins into music is part of Buehler’s larger work designing new proteins by borrowing ideas from nature and harnessing the power of AI. He has trained deep-learning algorithms to both translate the structure of existing proteins into their vibrational patterns and run the operation in reverse to infer structure from vibrational patterns. With these tools, he hopes to take existing proteins and create entirely new ones targeted for specific technological or medical needs.

    The process of turning science into art is like finding another “microscope” to observe nature, says Buehler. It has also opened his work to a broader audience. More than a year after “Viral Counterpoint’s” debut, the piece has racked up more than a million downloads on SoundCloud. Some listeners were so moved they asked Buehler for permission to create their own interpretation of his work. In addition to Won, the violinist in South Korea, the piece was picked up by a ballet company in South Africa, a glass artist in Oregon, and a dance professor in Michigan, among others.

    A “suite” of homespun ballets

    The Joburg Ballet shut down last spring with the rest of South Africa. But amid the lockdown, “Viral Counterpoint” reached Iain MacDonald, artistic director of Joburg Ballet. Then, as now, the company’s dancers were quarantined at home. Putting on a traditional ballet was impossible, so MacDonald improvised; he assigned each dancer a fragment of Buehler’s music and asked them to choreograph a response. They performed from home as friends and family filmed from their cellphones. Stitched together, the segments became “The Corona Suite,” a six-minute piece that aired on YouTube last July.

    In it, the dancers twirl and pirouette on a set of unlikely stages: in the stairwell of an apartment building, on a ladder in a garden, and beside a glimmering swimming pool. With no access to costumes, the dancers made do with their own leotards, tights, and even boxer briefs, in whatever shade of red they could find. “Red became the socially-distant cohesive thread that tied the company together,” says MacDonald.

    MacDonald says the piece was intended as a public service announcement, to encourage people to stay home. It was also meant to inspire hope: that the company’s dancers would return to the stage, stay mentally and physically fit, and that everyone would pull through. “We all hoped that the virus would not cause harm to our loved ones,” he says. “And that we, as a people, could come out of this stronger and united than ever before.” 

    A Covid “sonnet” cast in glass

    Jerri Bartholomew, a microbiologist at Oregon State University, was supposed to spend her sabbatical last year at a lab in Spain. When Covid intervened, she retreated to the glass studio in her backyard. There, she focused on her other passion: making art from her research on fish parasites. She had previously worked with musicians to translate her own data into music; when she heard “Viral Counterpoint” she was moved to reinterpret Buehler’s music as glass art. 

    She found his pre-print paper describing the sonification process, digitized the figures, and transferred them to silkscreen. She then printed them on a sheet of glass, fusing and casting the images to create a series of increasingly abstract representations. After, she spent hours polishing each glass work. “It’s a lot of grinding,” she says. Her favorite piece, Covid Sonnet, shows the spike protein flowing into Buehler’s musical score. “His musical composition is an abstraction,” she says. “I hope people will be curious about why it looks and sounds the way it does. It makes the science more interesting.”

    Translating a lethal virus into movement

    Months into the pandemic, Covid’s impact on immigrants in the United States was becoming clear; Rosely Conz, a choreographer and native of Brazil, wanted to channel her anxiety into art. When she heard “Viral Counterpoint,” she knew she had a score for her ballet. She would make the virus visible, she decided, in the same way Buehler had made it audible. “I looked for aspects of the virus that could be applied to movement — its machine-like characteristics, its transfer from one performer to another, its protein spike that makes it so infectious,” she says.

    “Virus” debuted this spring at Alma College, a liberal arts school in rural Michigan where Conz teaches. On a dark stage shimmering with red light, her students leaped and glided in black pointe shoes and face masks. Their elbows and legs jabbed at the air, almost robotically, as if to channel the ugliness of the virus. Those gestures were juxtaposed by “melting movements” that Rosely says embody the humanity of the dancer. The piece is literally about the virus, but also the constraints of making art in a crisis; the dancers maintained six feet of distance throughout. “I always tell my students that in choreography we should use limitation as possibility, and that is what I tried to do,” she says. 

    Back at MIT, Buehler is planning several more “Protein Antibody” performances with Won this year. In the lab, he and Hu, his PhD student, are expanding their study of the molecular vibrations of proteins to see if they might have therapeutic value. “It’s the next step in our quest to better understand the molecular mechanics of the life,” he says. More

  • 175 Shares159 Views

    in Information Technology

    Florida water treatment plant was involved in second security incident before poisoning attempt: report

    A new study from Dragos has found that a water treatment plant in Oldsmar, Florida — where hackers attempted to poison the town’s water earlier this year — was also involved in another potential breach at the same time. A browser being used on the plant’s network was traced back to a “watering hole” attack that was allegedly targeting water utilities across the country.

    ZDNet Recommends

    “We have medium confidence it did not directly compromise any organization,” the report said. “But it does represent an exposure risk to the water industry and highlights the importance of controlling access to untrusted websites, especially for Operational Technology and Industrial Control System environments.”The tiny town in central Florida made national news in February when hackers gained remote access to systems at a local water plant and tried to elevate levels of certain chemicals which would have been poisonous to the town’s residents. The attack was stopped before the water levels could be changed but the situation, like the recent ransomware attack on Colonial Pipeline, put a spotlight on how unprotected much of the critical infrastructure in the US is. Researchers with Dragos found that the WordPress website of a water infrastructure construction company in Florida was “hosting malicious code” in the footer file of their website as a way to lure in operators at water utilities in the state and elsewhere. The attackers allegedly took advantage of one of the many vulnerabilities that can be found in WordPress’ plugins and inserted the code, which Dragos identified as the Tofsee malware, at some point in December 2020.The report found that the website with the malicious code “was visited by a browser from the city of Oldsmar” on February 5 at 9:49 am, the same day of the poisoning event. The water plant in Oldsmar was far from the only organization that visited the site with the malicious code, according to the report. Dragos researchers found that between December 2020 and February 16, when the vulnerability was dealt with, more than 1,000 computers across the country were “profiled by the malicious code.” 

    Dozens of computers from state and local government agencies, water industry-related private companies, municipal water utility customers, and others visited the site during that two month span, according to Dragos. Despite visiting the site on the same day of the attack, the watering hole attack was not connected to the poisoning attack, Dragos reiterated. “We do not understand why the adversary chose this specific Florida water construction company site to compromise and to host their code. Interestingly, and unlike other watering hole attacks, the code did not deliver exploits or attempt to achieve access to victim computers,” Dragos researchers wrote. 

    “With the forensic information we collected so far, Dragos’ best assessment is that an actor deployed the watering hole on the water infrastructure construction company site to collect legitimate browser data for the purpose of improving the botnet malware’s ability to impersonate legitimate web browser activity,” the report said. Cybersecurity experts noted that the report confirmed what many have said for years about the country’s inability to protect vital infrastructure from cyberattacks. ThycoticCentrify vice president Bill O’Neill said the report was just another example of how organizations are dealing with a slate of vulnerabilities that can be exploited at any moment by attackers. “Attacks like these make it abundantly clear that we’re entering a new era of digital warfare. A digital Pearl Harbor has long been a fear of experts as our adversaries look to cause disturbances amongst our critical infrastructure,” O’Neill said. “Any major attack on our energy, water, or transportation systems could accomplish that.”Yaniv Bar-Dayan, CEO of Vulcan Cyber, explained that the watering hole attack had the makings of a very sophisticated attack and noted that it all started with a “lowly, vulnerable WordPress plugin.” “Vulnerability remediation is the dirty job of the cyber security industry. Nobody really likes to do it, and it doesn’t get the attention and resources it deserves until it’s too late,” Bar-Dayan said. “These days, a WordPress plugin vulnerability can lead to the poisoning of a water supply or the taking down of an oil pipeline.” Other experts said the findings simply confirmed the need for constant updates to be made to an organization’s content management system. The attack also highlighted how hackers use some efforts to learn what works and gather data as opposed to leveraging vulnerabilities for any specific action, according to New Net Technologies security research vice president Dirk Schrader.”For those on the defense, it confirms the need to maintain a high level of cyber hygiene and to be able to detect any malicious changes in the infrastructure,” Schrader said.  More

  • 63 Shares99 Views

    in Artificial Intelligence

    Jeremy Kepner named SIAM Fellow

    Jeremy Kepner, a Lincoln Laboratory Fellow in the Cyber Security and Information Sciences Division and a research affiliate of the MIT Department of Mathematics, was named to the 2021 class of fellows of the Society for Industrial and Applied Mathematics (SIAM). The fellow designation honors SIAM members who have made outstanding contributions to the 17 mathematics-related research areas that SIAM promotes through its publications, conferences, and community of scientists. Kepner was recognized for “contributions to interactive parallel computing, matrix-based graph algorithms, green supercomputing, and big data.”

    Since joining Lincoln Laboratory in 1998, Kepner has worked to expand the capabilities of computing at the laboratory and throughout the computing community. He has published broadly, served on technical committees of national conferences, and contributed to regional efforts to provide access to supercomputing.

    “Jeremy has had two decades of contributing to the important field of high performance computing, including both supercomputers and embedded systems. He has also made a seminal impact to supercomputer system research. He invented a unique way to do signal processing on sparse data, critically important for parsing through social networks and leading to more efficient use of parallel computing environments,” says David Martinez, now a Lincoln Laboratory fellow and previously a division head who hired and then worked with Kepner for many years.

    At Lincoln Laboratory, Kepner originally led the U.S. Department of Defense (DoD) High Performance Embedded Computing Software Initiative that created the Vector, Signal and Image Processing Library standard that many DoD sensor systems have utilized. In 1999, he invented the MatlabMPI software and in 2001 was the architect of pMatlab (Parallel Matlab Toolbox) that has been used by thousands of Lincoln Laboratory staff and scientists and engineers worldwide. In 2011, the Parallel Vector Tile Optimizing Library (PVTOL), developed under Kepner’s direction, won an R&D 100 Award.

    “Jeremy has been a world leader in moving the state of high performance computing forward for the past two decades,” says Stephen Rejto, head of Lincoln Laboratory’s Cyber Security and Information Sciences Division. “His vision and drive have been invaluable to the laboratory’s mission.”

    Kepner led a consortium to pioneer the Massachusetts Green High Performance Computing Center, the world’s largest and, because of its use of hydropower, “greenest” open research data center, which is enabling a dramatic increase in MIT’s computing capabilities while reducing its CO2 footprint. He led the establishment of the current Lincoln Laboratory Supercomputing Center, which boasts New England’s most powerful supercomputer. In 2019, he helped found the U.S. Air Force-MIT AI Accelerator, which leverages the expertise and resources of MIT and the Air Force to advance research in artificial intelligence.

    “These individual honors are a recognition of the achievements of our entire Lincoln team to whom I am eternally indebted,” Kepner says.

    Kepner’s recent work has been in graph analytics and big data. He created a novel database management language and schema (Dynamic Distributed Dimensional Data Model, or D4M), which is widely used in both Lincoln Laboratory and government big data systems.

    His publications range across many fields — data mining, databases, high performance computing, graph algorithms, cybersecurity, visualization, cloud computing, random matrix theory, abstract algebra, and bioinformatics. Among his works are two SIAM bestselling books, “Parallel MATLAB for Multicore and Multinode Computers” and “Graph Algorithms in the Language of Linear Algebra.” In 2018, he and coauthor Hayden Jananthan published “Mathematics of Big Data” as one of the books in the MIT Lincoln Laboratory series put out by MIT Press.

    Kepner, who joined SIAM during his graduate days at Princeton University, has not only published books and articles through SIAM but also been involved with the SIAM community’s activities. He has served as vice chair of the SIAM International Conference on Data Mining; advises a SIAM student section; and enlisted SIAM’s affiliation with the High Performance Extreme (originally Embedded) Computing (HPEC) conference, in which he has had “an instrumental role in bringing together the high performance embedded computing community and which under his leadership became an IEEE conference in 2012,” according to Martinez, who founded the Lincoln Laboratory-hosted HPEC conference in 1997.

    Kepner is the first Lincoln Laboratory researcher to attain the rank of SIAM Fellow and the ninth from MIT. More

  • 163 Shares179 Views

    in Information Technology

    Businesses are getting better at security. But they're still forgetting one big risk

    With major cyber attacks on critical infrastructure such as the SolarWinds attack, the Florida’s water treatment facility hack, and the US East Coast’s Colonial Pipeline ransomware crisis, the security of products — and not just information systems — really need to be taken more seriously, argues Chris Wysopal, founder and CTO of code scanning company Veracode.  While the CISO protects information in the enterprise, Wysopal is arguing this week at the RSA 2021 conference that products need an equivalent level of attention to enterprise information systems. His call for greater focus on product security comes as supply chain attacks are on the rise and governments across the world attempt to grapple with the problem of products that have been tampered with enter an organization.  “Products are different. Products leave the enterprise. Think of Tesla’s product security. It’s the car. You could think of a medical device company, but even in more information-oriented companies, it’s an app, it’s a standalone website and they’re starting to become outside of the enterprise. They have a life of their own,” Wysopal tells ZDNet. Wysopal is notable figure in the cybersecurity scene, and was one of the original vulnerability researchers and one of seven member of the L0pht ‘hacker think tank’ who told the US Senate in 1998 that the group could bring down the internet in 30 minutes.Wysopal reckons products like these need a C-level exec with a better engineering skillset than a CISO typically has — a role more focused on monitoring networks and systems to keep hackers out. “Historically, a CISO has not been required to build in security in to a piece of software or a device,” he says.   “The traditional CISO doesn’t have that security engineering and product engineering background. They traditionally have grown up through compliance or network security, and they don’t have the understanding of software or code-level vulnerabilities. So you’ll have a lot of times where you have product security not reporting to a CISO, but reporting to the VP of engineering.”

    At Veracode, the CISO reports to him as the CTO, while his head of product, which sits at a director level, also reports to him. “Product security is a separate function, even at Veracode. And we’re a software-as-a-service company. We don’t ship any products or anything IoT, which I think really requires an elevated product security person.””It’s more important than the security of the rest of the business,” he argues, adding that at some point, apps become the product rather than just an extension of backend systems. This is relevant to the banking, insurance, retail, government and other sectors that now create apps that differentiate the business amongst competitors.   “The risk of that software starts to become more important,” he says. And attackers are getting ever smarter, as shown by the SolarWinds attack.”When someone is planting a sophisticated backdoor, you’re not going to be able to detect it just by looking at the code,” he says.”That’s why the integrity and security of the software development pipeline has become so important. Because that’s how you protect against someone inserting a backdoor like in SolarWinds. So instead of hoping to look at that binary artifact at the end and hoping to detect it — that’s not a good solution to this type of attack.” The solution is, he says, to have good security on all the different parts of the pipeline. This includes making sure that developers who have permission to modify code use two factor authentication when accessing a code repository to update code. They should also be cryptographically signing all the different artifacts that become part of the final build of a software product.Wysopal is optimistic that US president Joe Biden’s cybersecurity-focused executive order will have a positive impact on how cybersecurity is handled in the private sector in the US. “We see that the requirements for doing business with the federal government will be adopted in the private sector. Enterprises in lots of different sectors will push this on to their vendors. Cyber insurance companies will look at this and say, ‘Hey, this is lowering the risk of the federal government and if you do these same practices, your insurance premiums will be less.’ “The federal government is setting a good example. Parallel to that, we see that Congress, which can pass laws that affect everyone doing business in the US. Congress will also learn from this and will codify some of this into law.”In other words, Biden’s executive order, while only applying to federal agencies, could have major implications for classical critical infrastructure as well as banking, healthcare and other sectors the US considers vitally important. “That could be dictated by law. It might not just be the market making it happen,” he says. More

  • 175 Shares159 Views

    in Information Technology

    Microsoft: This new open source tool helps you test your defences again hacker attacks

    Microsoft has released SimuLand, an open-source project which aims to help security teams reproduce known attack scenarios – and test just how good Microsoft’s core security products are. SimuLand is a set of lab environments that allow researchers to test their Microsoft defenses. The framework can be used by researchers to test and verify the effectiveness of related Microsoft 365 Defender, Azure Defender, and Azure Sentinel detections. Microsoft plans to add more attack scenarios in future, but said the aim of the project is to help security teams understand the underlying behavior and functionality of adversary tradecraft, and identify mitigations and attacker paths by documenting preconditions for each attacker action, and thus validate and tune detection capabilities.Currently, it only includes the environment for “Golden SAML AD FS Mail Access” — an attack on Microsoft’s Active Director Federation Services (AD FS) authentication scheme. That’s a notable one, which affects Microsoft 365, and something similar was used in conjunction with the Solar Winds software supply chain attack that impacted FireEye and Microsoft.   The US and UK accused Russian intelligence of the SolarWinds attack. As FireEye explained last month, the hackers stole the token-signing certificate from an organization’s AD FS server, which let them bypass MFA and access Microsoft cloud services as if they were an approved user. It took advantage of the design of processes for on-premise AD servers authenticating to cloud-based Microsoft 365 services, such as email.   According to Microsoft, its tool will allow researchers to “simulate an adversary stealing the AD FS token signing certificate, from an “on-prem” AD FS server, in order to sign SAML token, impersonate a privileged user and eventually collect mail data in a tenant via the Microsoft Graph API.”Microsoft promises that SimuLand will “extend threat research using telemetry and forensic artifacts generated after each simulation exercise.”

    Future improvements to the project include: A data model to document the simulation steps in a more organized and standardized way.A CI/CD pipeline with Azure DevOps to deploy and maintain infrastructure.Automation of attack actions in the cloud via Azure Functions.Capabilities to export and share telemetry generated with the InfoSec community.Microsoft Defender evaluation labs integration.Azure Sentinel, Microsoft’s cloud-based security information and event management (SIEM) system is also in focus. SimuLand will help users map out threats in Sentinel when investigating an attack.  More

  • 100 Shares149 Views

    in Information Technology

    This ransomware-spreading malware botnet just won't go away

    The Phorpiex malware botnet has lurked around the internet for years and is used to deliver ransomware, spam email and more, but now Microsoft’s security team are taking a closer look at it. 

    ZDNet Recommends

    The botnet has been known for using old-fashioned worms that spread via removable USB drives and instant messaging apps, began diversifying its infrastructure in recent years to become more resilient and to deliver more dangerous payloads, Microsoft said. The botnet’s geographic targeting for bot distribution and installation expanded, too, it said: more recent activity shows a shift to a more global distribution.Phorpiex itself came under attack in early 2020 after someone apparently hijacked its backend and started uninstalling the spamming functionality from infected hosts. The hijacker even developed a popup warning users to install antivirus and update their computers. Security firm Check Point noted in November 2020 that Phorpiex had been distributing the Avaddon ransomware, a then-new ransomware service rented out for other cybercrime groups to infect targets. “Phorpiex is one of the oldest and most persistent botnets, and has been used by its creators for many years to distribute other malware payloads such as GandCrab and Avaddon ransomware, or for sextortion scams,” Check Point malware analysts noted.  One reason Microsoft is taking an interest in it is that the Phorpiex bot disables Microsoft Defender antivirus to maintain persistence on target machines.  “This includes modifying registry keys to disable firewall and antivirus popups or functionality, overriding proxy and browser settings, setting the loader and executables to run at startup, and adding these executables to the authorized application lists,” Microsoft notes in a blogpost. 

    Enterprise customers can prevent these attempts by enabling tamper protection in Microsoft Defender for Endpoint, Microsoft’s cloud-based advanced security feature, which will automatically revert changes made by the bot.  According to Check Point, in January Phorpiex was the second largest botnet to Emotet botnet, which law enforcement decommissioned in January and defanged in April.  Microsoft notes that from December 2020 to February 2021, the Phorpiex bot loader was encountered in 160 countries. The highest level of encounters were in Mexico (8.5%), Kazakhstan (7.8%), and Uzbekistan (7.3%). Unusually, US encounters only accounted for 2.8%.”The combination of the wide variety of infection vectors and outcomes makes the Phorpiex botnet appear chaotic at first glance. However, for many years Phorpiex has maintained a consistent internal infrastructure using similar domains, command-and-control (C2) mechanisms, and source code,” Microsoft threat researchers note. While the bot loader targets computers in Mexico and western Asia, its spam and extortion campaigns target multiple regions and languages. “We observed Phorpiex operators requiring payment primarily through Bitcoin and Dash. Examples of one such cryptocurrency profit volume from a campaign in late February 2021 targeting English speaking users is below, with the subject ‘Payment from your account’,” says Microsoft.  The group made $13,000 in just 10 days using social engineering tricks like claiming in messages there were security bugs in Zoom. The scammers claimed the bug allowed them to capture video material, which they would use to extort victims. Ransomware distribution possibly presents the greatest threat. The Avaddon ransomware, distributed by Phorpiex, “performs language and regional checks for Russia or Ukraine before running to ensure only favored regions are targeted,” according to Microsoft.Avaddon appears to be more of an automated type of ransomware than hands-on-keyboard operated ransomware. Avaddon usually demands a ransom of $700 worth of Bitcoin.  More

  • 175 Shares159 Views

    in Information Technology

    Irish court issues injunction against Conti hackers to stop health service data exposure, sale

    Dublin’s High Court has issued an injunction against the Conti ransomware group to stop data belonging to Ireland’s health service from becoming public. 

    In what appears to be an effort at damage control, the injunction against “persons unknown” would make it illegal for information stolen during a ransomware attack against the Health Service Executive (HSE) from being shared, processed, sold, or otherwise published online, as noted by the Financial Times. The ransomware attack took place on May 14. The HSE pulled all of its systems offline to try and mitigate the spread of infection, causing widespread disruption to healthcare services as a consequence.  Ireland’s HSE is responsible for healthcare services across Ireland. While the ongoing COVID-19 vaccination program and ambulance services carried on as normal, some outpatient services — including those offered by maternity units and X-rays — were canceled.  In addition, the healthcare service has warned that delays are possible in receiving COVID-19 test results.  Irish government officials have branded the attack, thought to be the responsibility of the Conti ransomware group, as possibly one of the most “significant” cases of a cyberattack against Ireland.  A ransom payment was sought. The FT says the amount requested was $20 million, but in line with Irish policy, officials say it will not be paid. 

    “This criminal ransomware attack has had a significant impact on hospital appointments and there continues to be major disruptions,” the HSE says. “We are asking the public to be patient with us, to bear with us, and be aware that our staff are working around the clock to ensure patients receive the best and safest possible care in these circumstances.” The impact of encrypted hospital systems, especially in a time of a global pandemic, is profound enough that the ransomware operators have reportedly offered the HSE a decryption key without payment. If the tool works, this would allow the healthcare service to potentially regain access to encrypted systems, but there is no guarantee that it will be usable. The decryption software is currently undergoing a technical examination.  However, this does not mean Conti has given up in its extortion attempt of the HSE. Monday is reported to be the deadline for a potential public data leak, or sale, of the 700GB dataset Conti claims to have stolen. HSE CEO Paul Reid told the court that all of the organization’s data is “potentially compromised,” according to Independent.ie.The health service is currently working to rebuild its crippled IT system.  “Slow but steady progress is being made in assessing the impact and beginning to restore HSE IT systems,” the service says. “This work will take many weeks and we anticipate major disruption will continue due to the shutdown of our IT systems.” In the meantime, a doctor, speaking to Malwarebytes, has spoken of the burden the ransomware attack has placed on staff already overstretched due to the pandemic and a backlog of cases.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More